PT-2025-41534 · Unknown · Energy Crm

Andrea Intilangelo · Published 2025-10-10 · Updated 2025-11-03 · CVE-2025-40640

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Energy CRM version 2025

Description A stored Cross-Site Scripting (XSS) issue exists due to insufficient validation of user-supplied data. A remote user can potentially send a malicious query to an authenticated user, potentially leading to the theft of cookie session details. The issue is triggered by submitting a POST request to the ''/crm/create invoice submit.php'' endpoint, specifically utilizing the customerName 0 parameter.

Recommendations Apply input validation and sanitization to the customerName 0 parameter in the ''/crm/create invoice submit.php'' endpoint.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40640

Affected Products

Energy Crm

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-40640 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40640 · Vendor Advisory
• https://t.me/cveNotify/141347 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker · Note
• https://twitter.com/VulmonFeeds/status/1976584217011097927 · Twitter Post
• https://twitter.com/CVEnew/status/1976569855039173068 · Twitter Post
• https://t.me/CVEtracker/34557 · Telegram Post
• https://t.me/cveNotify/138116 · Telegram Post