CVE-2025-2974

LOW

Perfex CRM < 3.2.1 - Stored Cross-Site Scripting in Contracts Module

Title source: llm

Description

A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contract of the component Contracts. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.302026

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.302026

Exploit, Third Party Advisory, VDB Entry third-party-advisory

https://vuldb.com/?submit.522737

Exploit, Third Party Advisory exploit

https://bytium.com/stored-xss-in-perfex-crm-3-2-1-contracts-module/

Scores

CVSS v3 3.5

EPSS 0.0031

EPSS Percentile 22.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (1)

perfexcrm/perfex_crm < 3.2.1

Published Mar 31, 2025

Tracked Since Feb 18, 2026