VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 29, 2025· Updated Sep 29, 2025

HTML injection in Perfex CRM

CVE-2025-10343

Description

HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'expense_name' at the endpoint '/expenses/expense'.

Affected products

2
  • Rukovoditel/CRMllm-fuzzy
    Range: =3.2.1
  • Perfex CRM/Perfex CRMv5
    Range: 3.2.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.