Fairsketch Rise Ultimate Project Manager

SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search parameter to index.php/knowledge_base/get_article_suggestion/.

CodeCanyon RISE Ultimate Project Manager save sql injection

Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.

CodeCanyon RISE Ultimate Project Manager signin redirect

FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API.

A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using the file explorer in the admin dashboard when creating new folders.

In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable.

In Rise Ultimate Project Manager v1.8, XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable.

Multiple vulnerabilities in Fairsketch's RISE CRM Framework

Multiple vulnerabilities in Fairsketch's RISE CRM Framework

Multiple vulnerabilities in Fairsketch's RISE CRM Framework

Multiple vulnerabilities in Fairsketch's RISE CRM Framework

Multiple vulnerabilities in Fairsketch's RISE CRM Framework

Multiple vulnerabilities in Fairsketch's RISE CRM Framework

CodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injection