Cyber Posture

CVE-2025-60378

HighPublic PoC

Published: 10 October 2025

Published
10 October 2025
Modified
17 November 2025
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0015 35.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.

Security Summary

CVE-2025-60378 is a stored HTML injection vulnerability (CWE-79) in RISE Ultimate Project Manager & CRM. Published on 2025-10-10, it allows authenticated users to inject arbitrary HTML into invoices and messages. The injected content renders in emails, PDFs, and messaging/chat modules distributed to clients or team members. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its potential for confidentially and integrity impacts.

Attackers require only low-privileged authenticated access to exploit this remotely with low complexity and no user interaction. They can inject malicious HTML that executes when rendered for recipients, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging features exacerbate the threat by repeatedly distributing the payload to multiple recipients.

Mitigation guidance and additional details are available in vendor resources at http://rise.com and the GitHub repository https://github.com/ajansha/CVE-2025-60378.

Details

CWE(s)
CWE-79

Affected Products

fairsketch
rise ultimate project manager
≤ 3.9.4

MITRE ATT&CK Enterprise Techniques

T1534 Internal Spearphishing Lateral Movement
After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization.
attack.mitre.org →
T1566.002 Spearphishing Link Initial Access
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.
attack.mitre.org →
T1566.003 Spearphishing via Service Initial Access
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.
attack.mitre.org →
Why these techniques?

Stored HTML injection enables authenticated users to embed malicious links and content in legitimate emails, PDFs, recurring invoices, and CRM messaging/chat, facilitating internal spearphishing (T1534), spearphishing links (T1566.002), and spearphishing via service (T1566.003) for phishing, credential theft, BEC, and malware delivery.

References