CVE-2026-26211

CVE-2026-26211 is a stored cross-site scripting flaw (CWE-79) in Ekushey Project Manager CRM: the administrator-configured system name is written to the unauthenticated login page without output encoding, and the occurrence inside the page-header h4 element is parsed as HTML, so markup with event handlers placed in that field renders and executes. Planting a payload requires an administrator session, but once stored the script runs in the browser of every visitor who loads the login page, including unauthenticated visitors, within the origin serving the login form, and it persists until the system name setting is changed. An attacker with admin access (or a compromised administrator account) therefore gains JavaScript execution in visitors' browsers on the login-page origin, which can be used to alter or overlay the credential form, run arbitrary script in that origin's context, or phish credentials from visitors typing into the login form. All deployments of the product are potentially affected, though the CVSS 4.0 base score of 4.8 (medium) reflects that overall impact is limited and that high privileges are required to store the payload. No in-the-wild exploitation is known: the flaw is absent from CISA KEV, EPSS estimates a 0.3% 30-day exploitation probability (23rd percentile), and a single public proof-of-concept repository exists.

What to do: Verify the current system name setting and strip any HTML or event handlers from it, which immediately neutralizes any stored payload rendered on the login page. Apply a vendor fix when one is published (no fixed version is identified in the available data), and until then sanitize or HTML-encode the system name at output or restrict which administrators can change it. Because the login page is served without authentication, treat any visitor who loaded it during the exposure window as having been exposed to the injected script.