Skip to content
KitploitKITPLOIT
HerramientasBlog
Enviar
HerramientasBlog
Enviar

¡Herramientas de Hacking, PenTest y Ciberseguridad para tu Arsenal de Seguridad!

Kitploit es un directorio de herramientas de hacking, ciberseguridad y pentesting. Descubre las últimas actualizaciones de proyectos para encontrar vulnerabilidades, analizar sistemas, automatizar pruebas y fortalecer tu seguridad.

··Feeds·Contacto·Privacidad·© 2026 Kitploit

Directorio de Herramientas

Categorías

Ver todas las categorías
Loading categories
Herramientas/GitHubGitHub/lindhunt/cve-2026-26211
Vulnerability AnalysisExploitationWeb SecurityPapers & ResearchLearning & Education
GitHublindhunt/cve-2026-26211

CVE-2026-26211

Public disclosure and proof-of-concept for CVE-2026-26211, a stored XSS vulnerability in Ekushey Project Manager CRM v5.0, including technical details and impact analysis.

Ver Repositorio
14hace 12 díasAún no revisado

Más Populares

Ver todos →

Descubre las herramientas más usadas por nuestra comunidad.

Explora todas las herramientas

Explora nuestra colección de herramientas

Ver todas las herramientas →
Compartir
Contenido no disponible en el idioma solicitado. Mostrando versión en inglés.

CVE Badge CWE Badge Severity Status

CVE-2026-26211: Stored XSS in Ekushey Project Manager CRM

Product: Ekushey Project Manager CRM
Version: 5.0
Vulnerability: Stored Cross-Site Scripting (XSS)
CWE: CWE-79
Researcher: LINDAN TRI SAPUTRA
Initial Report: August 1, 2026

Summary

A stored Cross-Site Scripting (XSS) vulnerability was identified in Ekushey Project Manager CRM version 5.0. The issue exists in the application settings, specifically within the Name field. User-controlled HTML input is stored without proper sanitization or output encoding, leading to arbitrary JavaScript execution when the page is rendered.

Affected Component

Settings → Name

  • The configured application name is stored in the database.
  • It is subsequently displayed in the application interface without proper escaping.
  • Any authenticated user (Admin, Staff, or Client) viewing the rendered name is exposed to the vulnerability.

Proof of Concept (PoC)

  1. Log in to the application as an administrator.
  2. Navigate to Settings.
  3. Locate the system Name field.
  4. Insert the following harmless XSS test payload:
root@kitploit:~
  1. Save the settings.
  2. Open any page where the configured application name is displayed (e.g., Dashboard, Header, Emails).

The JavaScript executes when the stored value is rendered.

Impact

Because the payload is stored in the application, the issue affects all users not just the administrator who initially modified the setting. Depending on where the application name is rendered and which users can access those pages, the stored payload may execute in the browser of staff, clients, or other authenticated users.

Potential Impact Includes:

  • Arbitrary JavaScript execution in affected users' browsers
  • Application UI manipulation (e.g., defacement, fake notifications)
  • Phishing or spoofing within the trusted application origin
  • Performing actions within the victim's authenticated application context (session hijacking, CSRF bypass)

Video Proof of Concept

A video demonstration of CVE-2026-26211 is available below:

PoC Video Thumbnail
Click the image to watch the PoC on YouTube

Direct link: https://youtu.be/b8gRD9jpvak?si=otEalAgZexiENIfh

Disclosure Timeline

DateEvent
August 1, 2026Vulnerability submitted to VulnCheck
August 2026VulnCheck validated the submission and confirmed it qualifies for CVE assignment
August 2026CVE-2026-26211 assigned
August 25, 2026Public technical disclosure published per VulnCheck's request

Researcher

LINDAN TRI SAPUTRA
Independent Security Researcher
GitHub: https://github.com/lindan-tri-saputra

References

  • CVE-2026-26211: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26211
  • CWE-79: Improper Neutralization of Input During Web Page Generation (XSS)
    https://cwe.mitre.org/data/definitions/79.html

Disclaimer

This report is provided for educational and security awareness purposes only. The identified vulnerability has been responsibly disclosed to the vendor or relevant coordinating authority (VulnCheck) prior to public release. Unauthorized exploitation of this vulnerability is illegal and unethical.

Recommendations for Developers

To remediate this vulnerability:

  • Apply context-aware output encoding when rendering user-controlled input.
  • Implement strict input validation and sanitization for all settings fields.
  • Use Content Security Policy (CSP) headers to mitigate XSS risks.
  • Consider using HTML Purifier or similar libraries to filter rich-text input.

Stay secure, stay vigilant.

Descargar herramienta