PT-2025-39818

CVE-2025-10345

·

Published

2025-09-29

·

Updated

2026-10-19

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Perfex CRM version 3.2.1
Description An HTML injection issue exists in Perfex CRM version 3.2.1. This is due to insufficient validation of user-supplied data. The issue occurs when sending a POST request to the /admin/leads/lead endpoint with malicious HTML code in the name and address parameters. This allows for stored HTML injection.
Recommendations Apply appropriate input validation and sanitization to the name and address parameters in the /admin/leads/lead endpoint.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2025-10345
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com