CVE-2026-66031 is a stored cross-site scripting vulnerability in Creativeitem's Ekushey Project Manager CRM up to version 5.0. Authenticated client users can inject arbitrary HTML and JavaScript code via the Reply Ticket field. When Staff or Administrator users view the Support Ticket detail page, the malicious scripts execute in their browser sessions. This vulnerability arises from improper neutralization of input during web page generation, enabling persistent XSS attacks. No vendor advisory or patch information is provided, and the vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity.

The vulnerability allows authenticated users to store malicious scripts that execute in the browsers of privileged users (Staff or Administrators) when they view support tickets. This can lead to session hijacking, unauthorized actions, or disclosure of sensitive information within the context of the affected CRM application. The impact is limited to users with authenticated access and depends on their interaction with the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Reply Ticket field to trusted users only and consider implementing input validation or output encoding as a temporary mitigation. Monitor for suspicious activity related to support ticket replies. Avoid clicking on or viewing untrusted ticket replies in the CRM interface.