CVE-2025-41104

HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'custom_field_1' in '/estimate_requests/save_estimate_request'.

Score

CVSS 3.1 5.4 Medium

Status

Analyzed - cve-coordination@incibe.es

Published

2025-11-11

Last modified

2026-10-18

Weaknesses

CWE-79

Affected products

• Rise Crm Framework (Fairsketch)
• Rise Ultimate Project Manager (Fairsketch)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fairsketchs-rise-crm-framework