What’s Vulnerable › Vulnerabilities
CVE-2025-60378
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-10-10 · updated 2026-07-05
- Weakness: CWE-79
Description
Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.
Affected products
- Fairsketch RISE CRM Framework: before 3.9.4 — fixed in 3.9.4
How to fix
Upgrade to a fixed version: Fairsketch RISE CRM Framework 3.9.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-60378 or the next vulnerability affects your stack