CVE-2025-55903

—

CVSS 3.1

8.3 high

EPSS

<1%p24

Published

Oct 10, 2025 (Oct 10, 2025)

Modified

Jun 17, 2026

Description

A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate module. As a result, arbitrary HTML can be injected and rendered unescaped in client-facing documents.

Weakness: CWE-116
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.