PT-2025-41594 · Unknown · Perfex Crm

Ajansha + 1 · Published 2025-10-10 · Updated 2025-10-10 · CVE-2025-55903

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Perfex CRM version 3.3.1

Description The application does not properly sanitize user input in the "Bill To" address field within the estimate module. This allows for the injection of arbitrary HTML that is rendered without escaping in client-facing documents. The vulnerable parameter is the "Bill To" address field.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider sanitizing user input for the "Bill To" address field within the estimate module.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2025-55903

Affected Products

Perfex Crm

References · 6

• 🔥 https://github.com/ajansha/CVE-2025-55903 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-55903 · Security Note
• https://twitter.com/VulmonFeeds/status/1976794107356795197 · Twitter Post
• https://codecanyon.net/item/perfex-powerful-open-source-crm/14013737 · Note
• https://twitter.com/CVEnew/status/1976735429182247279 · Twitter Post
• https://t.me/cveNotify/138262 · Telegram Post