CVE-2025-55903

A HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field within the estimate module. As a result, arbitrary HTML can be injected and rendered unescaped in client-facing documents.

• CWE-116

• https://codecanyon.net/item/perfex-powerful-open-source-crm/14013737
• https://github.com/ajansha/CVE-2025-55903

Published

Oct 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55888Cross-Site Scripting (XSS) vulnerability was discovered in t…7.3
• CVE-2025-5589The StreamWeasels Kick Integration plugin for WordPress is v…6.4
• CVE-2025-55893TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to comm…6.5
• CVE-2025-55895TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6…9.1
• CVE-2025-5590The Owl carousel responsive plugin for WordPress is vulnerab…8.8
• CVE-2025-55901TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to com…6.5
• CVE-2025-55904Open5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d…4
• CVE-2025-5591Kentico Xperience 13 is vulnerable to a stored cross-site sc…5.4
• CVE-2025-55910CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file …6.3
• CVE-2025-55911An issue Clip Bucket v.5.5.2 Build#90 allows a remote attack…6.5
• CVE-2025-55912An issue in ClipBucket 5.5.0 and prior versions allows an un…7.3
• CVE-2025-5592A vulnerability, which was classified as critical, has been …9.8