Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
References
| Link | Resource |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker | Third Party Advisory |
Configurations
History
03 Nov 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-energy-crm-status-tracker - Third Party Advisory | |
| CPE | cpe:2.3:a:energycrm:energy_crm:2025:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| First Time |
Energycrm
Energycrm energy Crm |
10 Oct 2025, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| References |
|
|
| Summary | (en) Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details. |
02 Oct 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-02 10:15
Updated : 2025-11-03 15:15
NVD link : CVE-2025-40646
Mitre link : CVE-2025-40646
CVE.ORG link : CVE-2025-40646
JSON object : View
Products Affected
energycrm
- energy_crm
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')