점검 대응높음KEV 미등록
CVE-2025-60378
n/a n/a, rise ultimate project manager 취약점
Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.
- 대응 우선순위
- 점검
- CVSS
- 8.1
- EPSS
- 1.01% 백분위 59.6% · 2026.08.03 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2025.10.11