CVE-2025-10346: Perfex CRM XSS Vulnerability

CVE-2025-10346 Overview

CVE-2025-10346 is a stored HTML injection vulnerability in Perfex CRM v3.2.1. The flaw stems from insufficient validation of user-supplied input in the subject parameter of the knoewledge_base/article endpoint. Attackers can submit crafted POST requests that persist malicious HTML into knowledge base articles. When other users view the affected content, the injected markup renders in their browser context.

The vulnerability is classified under [CWE-79], covering improper neutralization of input during web page generation. Exploitation requires user interaction to view the tainted article but no authentication complexity beyond standard access. Perfex CRM is a widely deployed customer relationship management platform used by small and mid-sized businesses.

Critical Impact
Authenticated attackers can persist arbitrary HTML content into knowledge base articles, enabling phishing lures, content spoofing, and downstream social engineering against Perfex CRM users.

Affected Products

Perfex CRM v3.2.1
Vendor: perfexcrm
CPE: cpe:2.3:a:perfexcrm:perfex_crm:*:*:*:*:*:*:*:*

Discovery Timeline

2025-09-29 - CVE-2025-10346 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10346

Vulnerability Analysis

The vulnerability resides in the knowledge base article submission workflow. Perfex CRM accepts a POST request to the knoewledge_base/article endpoint containing a subject parameter. The application stores this value without applying HTML entity encoding or context-aware output sanitization. When the article is later rendered to any authenticated user, the browser interprets the stored markup as active content.

This is a stored (persistent) injection, meaning a single successful request affects every subsequent viewer of the tainted resource. Unlike reflected variants, the payload does not require attacker-controlled links to reach victims. Content-based attacks such as spoofed login prompts, fake support notices, or redirect banners become practical against internal users. The injection is scoped to HTML rendering rather than full script execution, but attackers can still abuse form elements, styled overlays, and clickable links.

Root Cause

The root cause is missing input validation and output encoding on the subject field. The application trusts client-supplied HTML rather than escaping special characters such as <, >, and " before storage or display. No allowlist filter constrains permitted tags.

Attack Vector

Exploitation occurs over the network by submitting a POST request to the vulnerable endpoint with an HTML payload in the subject field. Victim interaction is required — a user must open the affected knowledge base article for the injected content to render.

Refer to the INCIBE Security Notice for additional technical context on the affected endpoint and parameter.

Detection Methods for CVE-2025-10346

Indicators of Compromise

Knowledge base article subjects containing raw HTML tags such as <img>, <iframe>, <form>, or <a href> instead of plain text.
POST requests to /knoewledge_base/article where the subject parameter contains angle brackets or HTML entities.
User reports of unexpected content, redirects, or credential prompts appearing inside knowledge base articles.

Detection Strategies

Inspect the tblknowledgebase (or equivalent) database table for rows whose subject field contains HTML markup characters.
Deploy web application firewall rules that flag POST bodies to the article endpoint containing <script, <iframe, or event handler attributes like onerror=.
Enable verbose HTTP access logging on the Perfex CRM host and review requests to knoewledge_base/article for anomalous payload sizes.

Monitoring Recommendations

Monitor authenticated user sessions for unusual article creation or edit activity, particularly from accounts with elevated permissions.
Correlate knowledge base changes with subsequent user reports of phishing or spoofed content.
Alert on outbound requests from user browsers to unfamiliar domains referenced from within knowledge base pages.

How to Mitigate CVE-2025-10346

Immediate Actions Required

Restrict knowledge base article creation and editing privileges to trusted administrative users until a patch is applied.
Audit existing knowledge base articles for previously injected HTML payloads and remove tainted entries.
Enforce Content Security Policy (CSP) headers on the Perfex CRM application to limit the impact of rendered markup.

Patch Information

At the time of publication, no vendor advisory or fixed version is listed in the enriched CVE data. Monitor the INCIBE Security Notice and the Perfex CRM vendor channels for an official patched release beyond v3.2.1.

Workarounds

Place the Perfex CRM application behind a web application firewall configured to strip or block HTML tags in the subject parameter of knoewledge_base/article requests.
Apply server-side input filtering at a reverse proxy to reject POST bodies containing < or > characters on the affected endpoint.
Communicate the risk to end users and instruct them to treat unexpected forms, links, or login prompts inside knowledge base articles as suspicious.

bash

# Example NGINX rule to block HTML characters in the vulnerable parameter
location /knoewledge_base/article {
    if ($request_method = POST) {
        if ($request_body ~* "subject=[^&]*(%3C|<)") {
            return 403;
        }
    }
    proxy_pass http://perfex_backend;
}