CVE-2026-66028

Katalog CVE

CVSS 6.7 · Medium EPSS 0,61%

Kerentanan Incorrect Implementation of Authentication Algorithm. Skor CVSS 3.1 6.7 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement to create conflicting account states where multiple accounts share the same email address with different passwords, resulting in unpredictable authentication behavior and unauthorized account access.

Rincian

Terbit di NVD

27 Juli 2026

Terakhir diubah

28 Juli 2026

Status NVD

Deferred

CVSS 3.1

6.7 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-303: Incorrect Implementation of Authentication Algorithm

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://codecanyon.net/item/ekushey-project-manager-crm/9492104
• https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-66028
• https://www.vulncheck.com/advisories/ekushey-project-manager-crm-missing-uniqueness-constraint-via-client-emai...