Medium severity5.4NVD Advisory· Published Oct 2, 2025· Updated Jun 17, 2026

CVE-2025-40991

Description

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_file/upload/xxxx", affecting to "description" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Creativeitem/Ekushey Project Manager CRM
cpe:2.3:a:creativeitem:ekushey_project_manager_crm:5.0:*:*:*:*:*:*:*
Creativeitem/Creativeitemllm-create
Range: =5.0
Creativeitem/Ekushey CRMllm-fuzzy2 versions
=5.0+ 1 more
- (no CPE)range: =5.0
- (no CPE)range: 5.0

Patches

Vulnerability mechanics

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-creativeitem-productsnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000