CVE-2025-41106

MEDIUM

Fairsketch RISE Ultimate Project Manager < 3.9 - Cross-Site Scripting via First Name Parameter

Title source: llm
STIX 2.1

Description

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'first_name' in '/clients/save_contact/'.

References (1)

Core 1

Scores

CVSS v3 5.4
EPSS 0.0015
EPSS Percentile 4.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
fairsketch/rise_ultimate_project_manager < 3.9
Published Nov 11, 2025
Tracked Since Feb 18, 2026