Get real-time updates on Telegram
CVE-2026-66028: Ekushey Project Manager CRM 0 through 5.0
CVE-2026-66028. CVSS 3.1 base score 6.7 (MEDIUM, Vendor/CNA). EPSS 0.00613 (percentile 0.48682), scored 22-Oct-2026.
Affected technology
Ekushey Project Manager CRM · 0 through 5.0
Creativeitem
Description’s affected range: through version 5.0
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required
What an attacker can do
Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as low; integrity and availability impact as high.
- CWE
- CWE-303
- CCR priority
- 27.0 /100 (P4)
- CVSS 3.1
- 6.7 /10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H · Vendor/CNA
- EPSS
- 0.00613 · percentile 0.48754 · 2026-10-24
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-24 15:09:16.138216+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-24 15:07:27.951960+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-66028.html