CVE-2025-2974

Name of the Vulnerable Software and Affected Versions CodeCanyon Perfex CRM versions up to 3.2.1

Description A vulnerability has been found in the Contracts component of CodeCanyon Perfex CRM, affecting unknown code of the file /contract. The manipulation of the content argument leads to cross-site scripting. The attack can be initiated remotely.

Recommendations For CodeCanyon Perfex CRM versions up to 3.2.1, consider disabling access to the /contract endpoint of the Contracts component until a patch is available. Restrict the manipulation of the content argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.