Ekushey Project Manager CRM through version 5.0 contains a stored cross‑site scripting flaw that permits authenticated client users to inject arbitrary HTML and JavaScript into the client Name field on the Edit Profile page. The server stores the payload unsanitized, and when a Staff or Administrator views pages that display client names the malicious code executes within their browser context, enabling theft of session tokens, credential leakage, or other client‑side attacks. This weakness is identified as CWE‑79.

The affected product is Creativeitem’s Ekushey Project Manager CRM, versions up to and including 5.0. Users with client-level authentication who can edit a client’s profile are at risk, and Staff or Administrator users who view client information become victims when the injected code is rendered.

The CVSS score of 5.1 indicates medium severity for the vulnerability. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Attackers only need to be authenticated as a client to inject the payload, after which the code is stored and later triggered in privileged user sessions. The exploitation path is straightforward: a client submits a crafted name, it is persisted, and when a high‑privilege user visits a page that displays the client name the XSS payload executes.