PT-2025-39815 · Unknown · Perfex Crm

Published 2025-09-29 · Updated 2025-09-29 · CVE-2025-10342

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Perfex CRM version 3.2.1

Description A stored HTML injection exists due to insufficient validation of user-supplied data. The issue is triggered by sending a POST request to the /subscriptions/create API endpoint with malicious content in the name parameter. This allows for the injection of arbitrary HTML code.

Recommendations Apply input validation and sanitization to the name parameter in the /subscriptions/create API endpoint.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-10342

Affected Products

Perfex Crm

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-10342 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10342 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-perfex-crm · Note
• https://t.me/cveNotify/136774 · Telegram Post
• https://twitter.com/CVEnew/status/1972591781351993763 · Twitter Post
• https://t.me/CVEtracker/33616 · Telegram Post