CVE-2026-4165 MEDIUM

CVE-2026-4165: Worksuite HR, CRM and Project Management create cross site scripting

Vendor Worksuite

Product HR, CRM and Project Management

Weakness CWE-79 · XSS

Published March 15, 2026

Last update March 17, 2026

View on NVD All CVEs

CVSS base score

4.8/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability has been found in Worksuite HR, CRM and Project Management up to 5.5.25. The affected element is an unknown function of the file /account/orders/create. The manipulation of the argument Client Note leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

March 15, 2026 CVE published

March 17, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-4165 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

Identifiers

CVE CVE-2026-4165

CWE CWE-79

CVSS 4.8 / MEDIUM

Affected versions

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.0

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.1

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.2

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.3

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.4

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.5

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.6

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.7

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.8

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.9

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.10

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.11

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.12

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.13

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.14

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.15

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.16

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.17

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.18

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.19

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.20

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.21

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.22

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.23

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.24

Vendor Worksuite

Product HR, CRM and Project Management

Affected 5.5.25

CVE-2026-4165: Worksuite HR, CRM and Project Management create cross site scripting

01Description

02Disclosure timeline

03References

04Related CVE