CVE-2026-66030 is a stored cross-site scripting vulnerability in Creativeitem's Ekushey Project Manager CRM up to version 5.0. The flaw arises from improper neutralization of input during web page generation, specifically in the Ticket Title field on the Create New Ticket page. Authenticated client users can inject arbitrary HTML and JavaScript payloads that are stored and later executed in the browser sessions of privileged users (Staff or Administrator) when they access the Client Support page. This vulnerability allows attackers to execute scripts in the context of the affected users' sessions, potentially leading to session hijacking or other script-based attacks. No official patch or remediation guidance is currently available from the vendor, and no known exploits in the wild have been reported.

The vulnerability enables authenticated users to perform stored cross-site scripting attacks by injecting malicious scripts into ticket titles. These scripts execute in the browsers of Staff or Administrator users who view the affected page, potentially allowing attackers to hijack sessions, steal sensitive information, or perform actions on behalf of the victim users. The impact is limited to authenticated users injecting payloads and relies on privileged users viewing the malicious content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Create New Ticket page to trusted users only and consider implementing input validation or output encoding on the Ticket Title field as a temporary mitigation. Monitor vendor communications for official patches or updates.