CVE-2026-66030: Ekushey Project Manager CRM XSS Flaw

CVE-2026-66030 Overview

CVE-2026-66030 is a stored cross-site scripting (XSS) vulnerability in Ekushey Project Manager CRM through version 5.0. Authenticated client users can inject arbitrary HTML and JavaScript through the Ticket Title field on the Create New Ticket page. The application renders ticket titles without sanitization on the Client Support page, executing attacker-supplied scripts in the browser sessions of Staff and Administrator users who view that page. The flaw maps to CWE-79 and enables cross-privilege attacks against higher-privileged accounts.

Critical Impact
A low-privileged client user can execute JavaScript in Staff or Administrator browser sessions, enabling session theft, forced actions, and pivot to administrative functions.

Affected Products

Ekushey Project Manager CRM versions up to and including 5.0
Deployments exposing the Create New Ticket workflow to client users
Instances where Staff or Administrator accounts access the Client Support page

Discovery Timeline

2026-07-27 - CVE-2026-66030 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-66030

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the ticketing feature of Ekushey Project Manager CRM. An authenticated client submits a new support ticket and supplies a payload containing HTML or JavaScript in the Ticket Title field. The server persists the raw value in the ticket store without input filtering or output encoding. When Staff or Administrator users load the Client Support page, the application writes the stored title directly into the HTML response. The browser parses the injected markup and executes the script under the origin of the CRM application. This lets a low-privileged client user reach sessions that hold elevated permissions in the CRM.

Root Cause

The root cause is missing output encoding on the ticket title when rendering the Client Support view, combined with absent input validation on submission. The application treats user-controlled text as trusted HTML rather than data, which violates the contextual escaping requirements described in CWE-79.

Attack Vector

Exploitation requires an authenticated client account and one interaction from a privileged viewer. The attacker creates a ticket with a script payload placed in the title. When a Staff or Administrator user opens the Client Support page, the payload executes. Available actions include stealing session cookies, issuing authenticated requests as the victim, modifying CRM data, or delivering additional payloads. No verified exploit code is published; see the VulnCheck advisory and the GitHub CVE disclosure for reference material.

Detection Methods for CVE-2026-66030

Indicators of Compromise

Ticket titles containing HTML tags such as <script>, <img, <svg, or onerror= handlers stored in the CRM database
Outbound requests from Staff or Administrator browsers to unknown domains immediately after loading the Client Support page
Unexpected session activity or privileged actions originating from Staff or Administrator accounts shortly after ticket views

Detection Strategies

Query the ticket table for title fields matching regular expressions that identify HTML tags or JavaScript event handlers
Enable Content Security Policy (CSP) reporting to capture inline script violations on the Client Support page
Review web server access logs for POST requests to the ticket creation endpoint containing URL-encoded angle brackets or script keywords

Monitoring Recommendations

Alert on anomalous administrative actions performed within seconds of a Staff user opening the Client Support page
Monitor for new outbound domains contacted by browsers during CRM sessions using DNS or proxy logs
Track ticket creation patterns from newly registered or low-activity client accounts targeting privileged reviewers

How to Mitigate CVE-2026-66030

Immediate Actions Required

Restrict access to the Client Support page until sanitization controls are verified
Audit existing ticket titles and remove or neutralize any entries containing HTML or script content
Rotate session tokens for Staff and Administrator accounts that recently accessed the Client Support page
Contact the vendor through the Codecanyon product page to confirm patch availability

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Administrators should track vendor updates on the Codecanyon product page and the GitHub CVE disclosure for remediation guidance.

Workarounds

Deploy a web application firewall rule that blocks angle brackets and common XSS keywords in the ticket title parameter
Apply a strict Content Security Policy that disallows inline scripts on CRM pages rendering user-supplied content
Enforce HttpOnly and SameSite attributes on session cookies to reduce impact of successful script execution
Limit client user registration and require verification before ticket creation privileges are granted

bash

# Example ModSecurity rule blocking HTML tags in the ticket title parameter
SecRule ARGS:ticket_title "@rx (?i)(<[a-z!/?]|on[a-z]+\s*=|javascript:)" \
  "id:1026066030,phase:2,deny,status:403,log,\
   msg:'CVE-2026-66030 Ekushey CRM XSS payload blocked'"