CVE-2025-2974

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability has been found in CodeCanyon Perfex CRM up to 3.2.1 and classified as problematic. This vulnerability affects unknown code of the file /contract of the component Contracts. The manipulation of the argument content leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
CodeCanyon	Perfex CRM	3.2.0; 3.2.1

References

https://bytium.com/stored-xss-in-perfex-crm-3-2-1-contracts-module/Exploit, Third Party Advisory
https://vuldb.com/?ctiid.302026Permissions Required, VDB Entry
https://vuldb.com/?id.302026Third Party Advisory, VDB Entry
https://vuldb.com/?submit.522737Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-297436.5D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting.CVE-2025-297445.4pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.CVE-2025-297457.5A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NT CVE-2025-297466.1Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and CVE-2025-29755.4A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file S CVE-2025-297568.3SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devic CVE-2025-297579.4An incorrect authorisation check in the the 'plant transfer' function of the Growatt cloud service allowed a malicous attacker with a valid CVE-2025-29765.4A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the componen CVE-2025-297664.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on arti CVE-2025-297684.4Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impac CVE-2025-297695.5libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence CVE-2025-29775.4A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown func