lindhunt/cve-2026-26211Public disclosure and proof-of-concept for CVE-2026-26211, a stored XSS vulnerability in Ekushey Project Manager CRM v5.0, including technical details and impact analysis.
CVE-2026-26211 — Stored XSS in Ekushey Project Manager CRM
Product: Ekushey Project Manager CRM Version: 5.0 Vulnerability: Stored Cross-Site Scripting (XSS) CWE: CWE-79 CVE: CVE-2026-26211 Researcher: LINDAN TRI SAPUTRA Initial Report: August 1, 2026
Summary
A stored Cross-Site Scripting (XSS) vulnerability was identified in Ekushey Project Manager CRM version 5.0.
The issue was found in the application settings, specifically the Name field.
User-controlled HTML input can be stored in this field and is later rendered by the application without proper sanitization or output encoding.
Affected Component
Settings → Name
The configured application name is stored and subsequently displayed in the application interface.
Proof of Concept
Log in to the application as an administrator.
Navigate to Settings.
Locate the system Name field.
Insert the following harmless XSS test payload:
Save the settings.
Open a page where the configured application name is displayed.
The JavaScript executes when the stored value is rendered.
Impact
Because the payload is stored in the application, the issue can affect users other than the administrator who initially modified the setting.
Depending on where the application name is rendered and which users can access those pages, the stored payload may execute in the browser of staff, clients, or other authenticated users.
Potential impact includes:
Video PoC
A video demonstration of CVE-2026-26211 is available here:
"▶ Watch PoC Video on YouTube" (https://youtu.be/b8gRD9jpvak?si=otEalAgZexiENIfh)
Direct video reference: https://youtu.be/b8gRD9jpvak?si=otEalAgZexiENIfh
Disclosure Timeline
CVE Reference
CVE-2026-26211
Researcher
LINDAN TRI SAPUTRA
Independent Security Researcher
