CVE-2026-66031

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1

Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply Ticket field. The stored scripts execute within the browser sessions of Staff or Administrator users when they access the Support Ticket detail page.

Recommendations Update Ekushey Project Manager CRM to a version newer than 5.0. As a temporary mitigation, restrict the use of the Reply Ticket field for client users until the update is applied.