CVE-2025-40643

Name of the Vulnerable Software and Affected Versions Energy CRM version 2025

Description A stored Cross-Site Scripting (XSS) issue exists due to insufficient validation of user-supplied data. A remote user can exploit this by sending a POST request to the /crm/create job submit.php endpoint, specifically utilizing the JobCreatedBy parameter. Successful exploitation could allow an attacker to steal the cookie session details of an authenticated user.

Recommendations Ensure proper validation of user input for the JobCreatedBy parameter in the /crm/create job submit.php endpoint.