Dashboard / CVE-2025-60378

CVE-2025-60378

HIGH 1 PoC
MEDIUM Priority: 0.09 BB Relevance: 76/100
Published: 2025-10-10 Modified: 2026-11-05 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: None

Description

Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
fairsketch rise_ultimate_project_manager < 3.9.4

References & Advisories (1)

https://github.com/ajansha/CVE-2025-60378
Exploit Mitigation Third Party Advisory

Proof of Concept (1)

—
https://github.com/ajansha/CVE-2025-60378
nomi-sec

Bug Bounty Relevance

76 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

8.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploitation Probability

1.10%
Raw Score 0.011040
Percentile 66.3%
Date 2026-11-13

EPSS Trend

2026-11-13
0.01104
2026-11-12
0.01104
2026-11-10
0.01104
2026-11-09
0.01104
2026-11-08
0.01104
2026-11-07
0.01104
2026-11-06
0.01104
2026-11-05
0.01104

Intelligence Sources

nvd ref →

External Links