CVE-2025-60378

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-60378 has a selected CVSS score of 8.1 (high); EIP currently links 1 repository PoC.

Description

Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 10, 2025 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHubajansha/CVE-2025-60378Repository PoCby ajansha0Writeup1 file

9.4 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a security advisory writeup for CVE-2025-60378, a stored HTML injection vulnerability in RISE Ultimate Project Manager & CRM. It describes the vulnerability, affected components, impact, and mitigation steps. It includes example HTML payloads and step-by-step reproduction instructions but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file documenting CVE-2025-60378, a stored HTML injection vulnerability in RISE CRM. It contains no executable code, no concealed payloads, and no instructions for the reviewer to perform harmful actions. The content is purely descriptive, providing vulnerability details, impact analysis, and mitigation guidance.

ClassificationWriteup
Model confidence100%
AuthenticationRequired
Languagesmarkdown
Target softwareRISE Ultimate Project Manager & CRM
Attack typesstored html injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a detailed technical writeup describing a vulnerability, its impact, and reproduction steps. It contains no executable code, scripts, or automated scanning logic. The 'Proof of Concept' section provides manual instructions and example HTML payloads but does not constitute an exploit or scanner.

README.md:1-213

Requirements

  • Authenticated user with invoice/message creation permissions in RISE CRMREADME.md:100-101
  • RISE CRM version prior to 3.9.4README.md:20-21

Observed behavior

  • Describes injecting HTML payloads into invoice line items, client notes, and messaging modulesREADME.md:15
  • Provides example HTML payloads for phishing, image tracking, and misleading linksREADME.md:81-126
  • Outlines manual steps to reproduce the vulnerability and verify HTML rendering in emails, PDFs, and chatREADME.md:103-145
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Documentation Only
README.mdThe entire artifact consists of a single Markdown file with no executable code, scripts, or binary payloads.README.md:1-213
Contact Information
https://www.linkedin.com/in/ajansha-shankar/Author contact information is present but does not constitute backdoor behavior.README.md:181
Review boundaries

What the analysis did not establish

  • Evidence consists of a single README.md file; no source code, scripts, or binaries are present.
  • The artifact is a static document; no dynamic behavior or execution context is available.
  • The 'Proof of Concept' section contains only manual steps and example HTML snippets, not functional exploit or scanner code.
  • Only the README.md file was provided; no other repository files were included for review.
  • Binary files were flagged as metadata-only and not analyzed, but none were identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

5