CVE-2026-26211: Stored XSS in Ekushey Project Manager CRM

Product: Ekushey Project Manager CRM
Version: 5.0
Vulnerability: Stored Cross-Site Scripting (XSS)
CWE: CWE-79
Researcher: LINDAN TRI SAPUTRA
Initial Report: August 1, 2026

---

Summary

A stored Cross-Site Scripting (XSS) vulnerability was identified in Ekushey Project Manager CRM version 5.0. The issue exists in the application settings, specifically within the Name field. User-controlled HTML input is stored without proper sanitization or output encoding, leading to arbitrary JavaScript execution when the page is rendered.

---

Affected Component

Settings → Name

• The configured application name is stored in the database.
• It is subsequently displayed in the application interface without proper escaping.
• Any authenticated user (Admin, Staff, or Client) viewing the rendered name is exposed to the vulnerability.

---

Proof of Concept (PoC)

1. Log in to the application as an administrator.
2. Navigate to Settings.
3. Locate the system Name field.
4. Insert the following harmless XSS test payload:

5. Save the settings.
6. Open any page where the configured application name is displayed (e.g., Dashboard, Header, Emails).

The JavaScript executes when the stored value is rendered.

---

Impact

Because the payload is stored in the application, the issue affects all users not just the administrator who initially modified the setting. Depending on where the application name is rendered and which users can access those pages, the stored payload may execute in the browser of staff, clients, or other authenticated users.

Potential Impact Includes:

• Arbitrary JavaScript execution in affected users' browsers
• Application UI manipulation (e.g., defacement, fake notifications)
• Phishing or spoofing within the trusted application origin
• Performing actions within the victim's authenticated application context (session hijacking, CSRF bypass)

---

Video Proof of Concept

A video demonstration of CVE-2026-26211 is available below:

Click the image to watch the PoC on YouTube

Direct link: https://youtu.be/b8gRD9jpvak?si=otEalAgZexiENIfh

---

Disclosure Timeline

Date	Event
August 1, 2026	Vulnerability submitted to VulnCheck
August 2026	VulnCheck validated the submission and confirmed it qualifies for CVE assignment
August 2026	CVE-2026-26211 assigned
August 25, 2026	Public technical disclosure published per VulnCheck's request

---

Researcher

LINDAN TRI SAPUTRA
Independent Security Researcher
GitHub: https://github.com/LindHunt

---

References

• CVE-2026-26211: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26211
• CWE-79: Improper Neutralization of Input During Web Page Generation (XSS)
  https://cwe.mitre.org/data/definitions/79.html

---

Disclaimer

This report is provided for educational and security awareness purposes only. The identified vulnerability has been responsibly disclosed to the vendor or relevant coordinating authority (VulnCheck) prior to public release. Unauthorized exploitation of this vulnerability is illegal and unethical.

---

Recommendations for Developers

To remediate this vulnerability:

• Apply context-aware output encoding when rendering user-controlled input.
• Implement strict input validation and sanitization for all settings fields.
• Use Content Security Policy (CSP) headers to mitigate XSS risks.
• Consider using HTML Purifier or similar libraries to filter rich-text input.

---

Stay secure, stay vigilant.