CVE-2026-66029 is a stored cross-site scripting vulnerability in Creativeitem's Ekushey Project Manager CRM up to version 5.0. The flaw occurs because the client Name field on the Edit Profile page does not properly sanitize input, allowing authenticated users to inject arbitrary HTML and JavaScript. When Staff or Administrator users access the Manage Clients or Manage Client Projects pages, the malicious scripts execute in their browsers, potentially leading to session hijacking or other script-based attacks. The vulnerability requires authenticated access and user interaction to trigger.

An attacker with authenticated access can inject malicious scripts that execute in the browsers of higher-privileged users (Staff or Administrator) viewing affected pages. This can lead to unauthorized actions performed in the context of those users, such as session theft or manipulation of displayed content. The vulnerability does not require elevated privileges to inject but does require authenticated user interaction to exploit. There is no indication of remote code execution or direct system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user input in the client Name field to safe characters or implement input sanitization and output encoding on affected pages. Monitor vendor communications for updates and apply official patches once released.