CVE-2026-26211: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Creativeitem Ekushey Project Manager CRM

The vulnerability arises because the administrator-configured system name is written to the login page in three locations without output encoding: the content attribute of the description meta element, the title element, and an h4 element in the page header. The h4 element is parsed as markup, so injected HTML and event handlers execute in the context of the login page. Since the login page is publicly accessible without authentication, any visitor loading it will execute the stored script within the origin of the site. Exploitation requires an administrator session to store the malicious system name, but the impact affects all visitors until the setting is changed.

An attacker with administrator privileges can inject malicious scripts that execute in the browsers of all visitors to the login page, including unauthenticated users. This can lead to theft of credentials entered on the login page or other malicious actions performed within the context of the vulnerable site. The vulnerability persists until the system name is changed, making it a persistent stored XSS risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid entering untrusted input into the system name field. If possible, restrict administrator access to trusted personnel only. Monitor for unusual activity related to the system name setting and consider temporarily disabling or restricting access to the login page if exploitation is suspected.