Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-76902 (GCVE-0-2026-76902)

Vulnerability from nvd – Published: 2026-09-18 19:57 – Updated: 2026-09-21 16:32

Title

CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. An unauthenticated caller who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations because the stored organization id is used only to locate the file rather than authorize the caller. This issue is fixed in version 1.7.4.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 16:31 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2978	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/3d…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76902",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T16:31:34.556423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T16:32:17.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. An unauthenticated caller who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations because the stored organization id is used only to locate the file rather than authorize the caller. This issue is fixed in version 1.7.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:57:50.286Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-93p7-j9r5-jc7q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-93p7-j9r5-jc7q"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2978",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2978"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/3d1f68be0778ce35362688296bf355c1cb2d86fb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/3d1f68be0778ce35362688296bf355c1cb2d86fb"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"
        }
      ],
      "source": {
        "advisory": "GHSA-93p7-j9r5-jc7q",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76902",
    "datePublished": "2026-09-18T19:57:50.286Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-09-21T16:32:17.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76901 (GCVE-0-2026-76901)

Vulnerability from nvd – Published: 2026-09-18 19:55 – Updated: 2026-09-21 20:48

Title

CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 19:40 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2976	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/34…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76901",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T19:40:07.714553Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T20:48:10.915Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record\u0027s id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:55:16.527Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-hxp2-5w5p-2grq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-hxp2-5w5p-2grq"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2976",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2976"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/34c7c3e5de2585208744926007530037a4ce4da5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/34c7c3e5de2585208744926007530037a4ce4da5"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"
        }
      ],
      "source": {
        "advisory": "GHSA-hxp2-5w5p-2grq",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76901",
    "datePublished": "2026-09-18T19:55:16.527Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-09-21T20:48:10.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76900 (GCVE-0-2026-76900)

Vulnerability from nvd – Published: 2026-09-18 19:56 – Updated: 2026-09-22 15:42

Title

CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:42 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2966	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/e0…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: = 1.7.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76900",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:42:07.309137Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:42:38.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.7.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:56:53.620Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2966",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2966"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/e0ae23ebf16faa062204d90a689fe33496541ada",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/e0ae23ebf16faa062204d90a689fe33496541ada"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"
        }
      ],
      "source": {
        "advisory": "GHSA-fg6q-pfj7-fghw",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76900",
    "datePublished": "2026-09-18T19:56:53.620Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-09-22T15:42:38.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76899 (GCVE-0-2026-76899)

Vulnerability from nvd – Published: 2026-09-18 19:58 – Updated: 2026-09-24 21:05

Title

CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 21:02 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2975	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/3e…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/b2…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T21:02:52.432818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T21:05:27.034Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284: Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:58:47.516Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-x6p7-vhgp-6r3q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-x6p7-vhgp-6r3q"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2975",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2975"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/b217166af2935c827c8d73bf55c563dd328692f5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/b217166af2935c827c8d73bf55c563dd328692f5"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"
        }
      ],
      "source": {
        "advisory": "GHSA-x6p7-vhgp-6r3q",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76899",
    "datePublished": "2026-09-18T19:58:47.516Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-09-24T21:05:27.034Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63647 (GCVE-0-2026-63647)

Vulnerability from nvd – Published: 2026-09-18 19:53 – Updated: 2026-09-18 20:19

Title

CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 20:19 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2719	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/6c…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63647",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:19:05.101870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:19:30.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user\u0027s workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user\u0027s stream, or use /sse/close to terminate another user\u0027s channel. This vulnerability is fixed in 1.7.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:53:51.932Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2719",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2719"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/6cb81deb53434ae7792673c50312ff91685d7f9d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/6cb81deb53434ae7792673c50312ff91685d7f9d"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2"
        }
      ],
      "source": {
        "advisory": "GHSA-9qg8-cm35-xqp4",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63647",
    "datePublished": "2026-09-18T19:53:51.932Z",
    "dateReserved": "2026-07-17T14:11:15.483Z",
    "dateUpdated": "2026-09-18T20:19:30.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63646 (GCVE-0-2026-63646)

Vulnerability from nvd – Published: 2026-09-18 19:52 – Updated: 2026-09-21 16:38

Title

CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey} calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/** as anonymous and the controller has no permission annotation. An unauthenticated caller can obtain field names, types, required flags, default values, options, validation rules, and binding sources for CRM modules, allowing reconstruction of the application data model and more targeted attacks against other inputs. This issue is fixed in version 1.7.2.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 16:37 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2725	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/ea…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63646",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T16:37:54.590530Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T16:38:13.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-46p5-m7pq-82hm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey} calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/** as anonymous and the controller has no permission annotation. An unauthenticated caller can obtain field names, types, required flags, default values, options, validation rules, and binding sources for CRM modules, allowing reconstruction of the application data model and more targeted attacks against other inputs. This issue is fixed in version 1.7.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:52:06.760Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-46p5-m7pq-82hm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-46p5-m7pq-82hm"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2725",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2725"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/ea8d5f128b94659ce881e9d034a37c18fa86bbbc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/ea8d5f128b94659ce881e9d034a37c18fa86bbbc"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2"
        }
      ],
      "source": {
        "advisory": "GHSA-46p5-m7pq-82hm",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63646",
    "datePublished": "2026-09-18T19:52:06.760Z",
    "dateReserved": "2026-07-17T14:11:15.483Z",
    "dateUpdated": "2026-09-21T16:38:13.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52745 (GCVE-0-2026-52745)

Vulnerability from nvd – Published: 2026-09-18 19:51 – Updated: 2026-09-19 14:01

Title

CordysCRM: Customer Public Pool Sorting Field SQL Injection

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-19 13:38 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2418	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/b5…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:38:03.983559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:01:29.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:51:17.097Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-xrcr-hj37-q83j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-xrcr-hj37-q83j"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2418",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2418"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xrcr-hj37-q83j",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: Customer Public Pool Sorting Field SQL Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52745",
    "datePublished": "2026-09-18T19:51:17.097Z",
    "dateReserved": "2026-06-08T14:00:43.573Z",
    "dateUpdated": "2026-09-19T14:01:29.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16223 (GCVE-0-2026-16223)

Vulnerability from nvd – Published: 2026-07-19 07:15 – Updated: 2026-07-21 14:48

Title

1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery

Summary

A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 14:47 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/380045	vdb-entrytechnical-description
https://vuldb.com/vuln/380045/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-16223	third-party-advisory
https://vuldb.com/submit/858045	third-party-advisory
https://vuldb.com/submit/858046	third-party-advisory
https://github.com/1Panel-dev/CordysCRM/issues/2687	issue-tracking
https://github.com/1Panel-dev/CordysCRM/issues/2688	exploitissue-tracking
https://github.com/1Panel-dev/CordysCRM/	product

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: 1.4.0 Affected: 1.4.1 cpe:2.3:a:1panel-dev:cordyscrm::::::::

Credits

liushaozhe (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16223",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T14:47:50.871621Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:48:42.529Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Third Party Edit Endpoint"
          ],
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "liushaozhe (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T07:15:09.159Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-380045 | 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/380045"
        },
        {
          "name": "VDB-380045 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/380045/cti"
        },
        {
          "name": "CVE-2026-16223 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-16223"
        },
        {
          "name": "Submit #858045 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858045"
        },
        {
          "name": "Submit #858046 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery (Duplicate)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858046"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2687"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2688"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-18T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-07-18T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-07-18T14:16:32.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-16223",
    "datePublished": "2026-07-19T07:15:09.159Z",
    "dateReserved": "2026-07-18T12:11:12.780Z",
    "dateUpdated": "2026-07-21T14:48:42.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16222 (GCVE-0-2026-16222)

Vulnerability from nvd – Published: 2026-07-19 06:45 – Updated: 2026-07-20 10:26

Title

1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery

Summary

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 10:26 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/380044	vdb-entrytechnical-description
https://vuldb.com/vuln/380044/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-16222	third-party-advisory
https://vuldb.com/submit/858043	third-party-advisory
https://vuldb.com/submit/858044	third-party-advisory
https://github.com/1Panel-dev/CordysCRM/issues/2685	issue-tracking
https://github.com/1Panel-dev/CordysCRM/issues/2686	exploitissue-tracking
https://github.com/1Panel-dev/CordysCRM/	product

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: 1.4.0 Affected: 1.4.1 cpe:2.3:a:1panel-dev:cordyscrm::::::::

Credits

liushaozhe (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16222",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T10:26:00.551051Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T10:26:14.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Third Party Endpoint"
          ],
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "liushaozhe (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T06:45:09.639Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-380044 | 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/380044"
        },
        {
          "name": "VDB-380044 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/380044/cti"
        },
        {
          "name": "CVE-2026-16222 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-16222"
        },
        {
          "name": "Submit #858043 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858043"
        },
        {
          "name": "Submit #858044 | 1Panel-dev CordysCRM 1.4.1  Server-Side Request Forgery (Duplicate)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858044"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2685"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2686"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-18T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-07-18T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-07-18T14:16:18.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-16222",
    "datePublished": "2026-07-19T06:45:09.639Z",
    "dateReserved": "2026-07-18T12:11:08.681Z",
    "dateUpdated": "2026-07-20T10:26:14.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-10567 (GCVE-0-2026-10567)

Vulnerability from nvd – Published: 2026-06-02 02:00 – Updated: 2026-06-02 13:11 X_Open Source

Title

1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting

Summary

A security vulnerability has been detected in 1Panel-dev CordysCRM up to 1.4.1. This impacts the function Save of the file src/main/java/cn/cordys/crm/system/service/ModuleFormService.java of the component ModuleFormController. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.7.0 will fix this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. Upgrading the affected component is recommended.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-02 13:10 UTC

CWE

CWE-79 - Cross Site Scripting
CWE-94 - Code Injection

Assigner

VulDB mitre root

References

9 references

URL	Tags
https://vuldb.com/vuln/367674	vdb-entrytechnical-description
https://vuldb.com/vuln/367674/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-10567	third-party-advisory
https://vuldb.com/submit/829316	third-party-advisory
https://github.com/1Panel-dev/CordysCRM/issues/2233	exploitissue-tracking
https://github.com/1Panel-dev/CordysCRM/pull/2356	issue-trackingpatch
https://github.com/1Panel-dev/CordysCRM/commit/c8…	patch
https://github.com/1Panel-dev/CordysCRM/releases/…	patch
https://github.com/1Panel-dev/CordysCRM/	product

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: 1.4.0 Affected: 1.4.1 Unaffected: 1.7.0 cpe:2.3:a:1panel-dev:cordyscrm::::::::

Credits

DaytimeHeaven (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10567",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T13:10:34.931269Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:11:19.461Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "ModuleFormController"
          ],
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "unaffected",
              "version": "1.7.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "DaytimeHeaven (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in 1Panel-dev CordysCRM up to 1.4.1. This impacts the function Save of the file src/main/java/cn/cordys/crm/system/service/ModuleFormService.java of the component ModuleFormController. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.7.0 will fix this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. Upgrading the affected component is recommended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T02:00:15.087Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-367674 | 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/367674"
        },
        {
          "name": "VDB-367674 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/367674/cti"
        },
        {
          "name": "CVE-2026-10567 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-10567"
        },
        {
          "name": "Submit #829316 | https://github.com/1Panel-dev/CordysCRM CordysCRM v1.4.1 Stored XSS",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/829316"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2233"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2356"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-01T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-01T18:41:58.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-10567",
    "datePublished": "2026-06-02T02:00:15.087Z",
    "dateReserved": "2026-06-01T16:36:54.499Z",
    "dateUpdated": "2026-06-02T13:11:19.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-10514 (GCVE-0-2026-10514)

Vulnerability from nvd – Published: 2026-06-01 23:45 – Updated: 2026-06-02 15:45 X_Open Source

Title

1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting

Summary

A vulnerability has been found in 1Panel-dev CordysCRM up to 1.6.2. This affects an unknown function of the file backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 mitigates this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. It is suggested to upgrade the affected component.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

2.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

2.4 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-02 14:53 UTC

CWE

CWE-79 - Cross Site Scripting
CWE-94 - Code Injection

Assigner

VulDB mitre root

References

9 references

URL	Tags
https://vuldb.com/vuln/367596	vdb-entry
https://vuldb.com/vuln/367596/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-10514	third-party-advisory
https://vuldb.com/submit/828296	third-party-advisory
https://github.com/1Panel-dev/CordysCRM/issues/2229	exploitissue-tracking
https://github.com/1Panel-dev/CordysCRM/pull/2356	issue-trackingpatch
https://github.com/1Panel-dev/CordysCRM/commit/c8…	patch
https://github.com/1Panel-dev/CordysCRM/releases/…	patch
https://github.com/1Panel-dev/CordysCRM/	product

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: 1.6.0 Affected: 1.6.1 Affected: 1.6.2 Unaffected: 1.7.0 cpe:2.3:a:1panel-dev:cordyscrm::::::::

Credits

DaytimeHeaven (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10514",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T14:53:38.174058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T15:45:28.904Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"
          ],
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "1.6.0"
            },
            {
              "status": "affected",
              "version": "1.6.1"
            },
            {
              "status": "affected",
              "version": "1.6.2"
            },
            {
              "status": "unaffected",
              "version": "1.7.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "DaytimeHeaven (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in 1Panel-dev CordysCRM up to 1.6.2. This affects an unknown function of the file backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 mitigates this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. It is suggested to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T23:45:12.138Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-367596 | 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/367596"
        },
        {
          "name": "VDB-367596 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/367596/cti"
        },
        {
          "name": "CVE-2026-10514 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-10514"
        },
        {
          "name": "Submit #828296 | https://github.com/1Panel-dev/CordysCRM CordysCRM v1.4.1 Stored XSS",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/828296"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2229"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2356"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-01T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-01T07:54:59.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-10514",
    "datePublished": "2026-06-01T23:45:12.138Z",
    "dateReserved": "2026-06-01T05:49:54.439Z",
    "dateUpdated": "2026-06-02T15:45:28.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76899 (GCVE-0-2026-76899)

Vulnerability from cvelistv5 – Published: 2026-09-18 19:58 – Updated: 2026-09-24 21:05

Title

CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 21:02 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2975	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/3e…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/b2…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T21:02:52.432818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T21:05:27.034Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284: Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:58:47.516Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-x6p7-vhgp-6r3q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-x6p7-vhgp-6r3q"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2975",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2975"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/b217166af2935c827c8d73bf55c563dd328692f5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/b217166af2935c827c8d73bf55c563dd328692f5"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"
        }
      ],
      "source": {
        "advisory": "GHSA-x6p7-vhgp-6r3q",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76899",
    "datePublished": "2026-09-18T19:58:47.516Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-09-24T21:05:27.034Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76902 (GCVE-0-2026-76902)

Vulnerability from cvelistv5 – Published: 2026-09-18 19:57 – Updated: 2026-09-21 16:32

Title

CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. An unauthenticated caller who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations because the stored organization id is used only to locate the file rather than authorize the caller. This issue is fixed in version 1.7.4.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 16:31 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2978	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/3d…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76902",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T16:31:34.556423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T16:32:17.392Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. An unauthenticated caller who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations because the stored organization id is used only to locate the file rather than authorize the caller. This issue is fixed in version 1.7.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:57:50.286Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-93p7-j9r5-jc7q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-93p7-j9r5-jc7q"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2978",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2978"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/3d1f68be0778ce35362688296bf355c1cb2d86fb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/3d1f68be0778ce35362688296bf355c1cb2d86fb"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"
        }
      ],
      "source": {
        "advisory": "GHSA-93p7-j9r5-jc7q",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76902",
    "datePublished": "2026-09-18T19:57:50.286Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-09-21T16:32:17.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76900 (GCVE-0-2026-76900)

Vulnerability from cvelistv5 – Published: 2026-09-18 19:56 – Updated: 2026-09-22 15:42

Title

CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:42 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2966	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/e0…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: = 1.7.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76900",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:42:07.309137Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:42:38.566Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.7.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:56:53.620Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2966",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2966"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/e0ae23ebf16faa062204d90a689fe33496541ada",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/e0ae23ebf16faa062204d90a689fe33496541ada"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"
        }
      ],
      "source": {
        "advisory": "GHSA-fg6q-pfj7-fghw",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76900",
    "datePublished": "2026-09-18T19:56:53.620Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-09-22T15:42:38.566Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-76901 (GCVE-0-2026-76901)

Vulnerability from cvelistv5 – Published: 2026-09-18 19:55 – Updated: 2026-09-21 20:48

Title

CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 19:40 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2976	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/34…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-76901",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T19:40:07.714553Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T20:48:10.915Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record\u0027s id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:55:16.527Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-hxp2-5w5p-2grq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-hxp2-5w5p-2grq"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2976",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2976"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/34c7c3e5de2585208744926007530037a4ce4da5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/34c7c3e5de2585208744926007530037a4ce4da5"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"
        }
      ],
      "source": {
        "advisory": "GHSA-hxp2-5w5p-2grq",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-76901",
    "datePublished": "2026-09-18T19:55:16.527Z",
    "dateReserved": "2026-08-19T22:43:14.890Z",
    "dateUpdated": "2026-09-21T20:48:10.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63647 (GCVE-0-2026-63647)

Vulnerability from cvelistv5 – Published: 2026-09-18 19:53 – Updated: 2026-09-18 20:19

Title

CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 20:19 UTC

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2719	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/6c…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63647",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:19:05.101870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:19:30.108Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user\u0027s workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user\u0027s stream, or use /sse/close to terminate another user\u0027s channel. This vulnerability is fixed in 1.7.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:53:51.932Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2719",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2719"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/6cb81deb53434ae7792673c50312ff91685d7f9d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/6cb81deb53434ae7792673c50312ff91685d7f9d"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2"
        }
      ],
      "source": {
        "advisory": "GHSA-9qg8-cm35-xqp4",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63647",
    "datePublished": "2026-09-18T19:53:51.932Z",
    "dateReserved": "2026-07-17T14:11:15.483Z",
    "dateUpdated": "2026-09-18T20:19:30.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63646 (GCVE-0-2026-63646)

Vulnerability from cvelistv5 – Published: 2026-09-18 19:52 – Updated: 2026-09-21 16:38

Title

CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey} calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/** as anonymous and the controller has no permission annotation. An unauthenticated caller can obtain field names, types, required flags, default values, options, validation rules, and binding sources for CRM modules, allowing reconstruction of the application data model and more targeted attacks against other inputs. This issue is fixed in version 1.7.2.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 16:37 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2725	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/ea…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63646",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T16:37:54.590530Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T16:38:13.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-46p5-m7pq-82hm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey} calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/** as anonymous and the controller has no permission annotation. An unauthenticated caller can obtain field names, types, required flags, default values, options, validation rules, and binding sources for CRM modules, allowing reconstruction of the application data model and more targeted attacks against other inputs. This issue is fixed in version 1.7.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:52:06.760Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-46p5-m7pq-82hm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-46p5-m7pq-82hm"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2725",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2725"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/ea8d5f128b94659ce881e9d034a37c18fa86bbbc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/ea8d5f128b94659ce881e9d034a37c18fa86bbbc"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2"
        }
      ],
      "source": {
        "advisory": "GHSA-46p5-m7pq-82hm",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63646",
    "datePublished": "2026-09-18T19:52:06.760Z",
    "dateReserved": "2026-07-17T14:11:15.483Z",
    "dateUpdated": "2026-09-21T16:38:13.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52745 (GCVE-0-2026-52745)

Vulnerability from cvelistv5 – Published: 2026-09-18 19:51 – Updated: 2026-09-19 14:01

Title

CordysCRM: Customer Public Pool Sorting Field SQL Injection

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-19 13:38 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/1Panel-dev/CordysCRM/security/…	x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2418	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/b5…	x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: < 1.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:38:03.983559Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:01:29.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T19:51:17.097Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-xrcr-hj37-q83j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-xrcr-hj37-q83j"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/pull/2418",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2418"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52"
        },
        {
          "name": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xrcr-hj37-q83j",
        "discovery": "UNKNOWN"
      },
      "title": "CordysCRM: Customer Public Pool Sorting Field SQL Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52745",
    "datePublished": "2026-09-18T19:51:17.097Z",
    "dateReserved": "2026-06-08T14:00:43.573Z",
    "dateUpdated": "2026-09-19T14:01:29.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16223 (GCVE-0-2026-16223)

Vulnerability from cvelistv5 – Published: 2026-07-19 07:15 – Updated: 2026-07-21 14:48

Title

1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery

Summary

A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 14:47 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/380045	vdb-entrytechnical-description
https://vuldb.com/vuln/380045/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-16223	third-party-advisory
https://vuldb.com/submit/858045	third-party-advisory
https://vuldb.com/submit/858046	third-party-advisory
https://github.com/1Panel-dev/CordysCRM/issues/2687	issue-tracking
https://github.com/1Panel-dev/CordysCRM/issues/2688	exploitissue-tracking
https://github.com/1Panel-dev/CordysCRM/	product

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: 1.4.0 Affected: 1.4.1 cpe:2.3:a:1panel-dev:cordyscrm::::::::

Credits

liushaozhe (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16223",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T14:47:50.871621Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T14:48:42.529Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Third Party Edit Endpoint"
          ],
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "liushaozhe (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T07:15:09.159Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-380045 | 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/380045"
        },
        {
          "name": "VDB-380045 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/380045/cti"
        },
        {
          "name": "CVE-2026-16223 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-16223"
        },
        {
          "name": "Submit #858045 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858045"
        },
        {
          "name": "Submit #858046 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery (Duplicate)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858046"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2687"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2688"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-18T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-07-18T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-07-18T14:16:32.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-16223",
    "datePublished": "2026-07-19T07:15:09.159Z",
    "dateReserved": "2026-07-18T12:11:12.780Z",
    "dateUpdated": "2026-07-21T14:48:42.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-16222 (GCVE-0-2026-16222)

Vulnerability from cvelistv5 – Published: 2026-07-19 06:45 – Updated: 2026-07-20 10:26

Title

1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery

Summary

A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 10:26 UTC

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB mitre root

References

8 references

URL	Tags
https://vuldb.com/vuln/380044	vdb-entrytechnical-description
https://vuldb.com/vuln/380044/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-16222	third-party-advisory
https://vuldb.com/submit/858043	third-party-advisory
https://vuldb.com/submit/858044	third-party-advisory
https://github.com/1Panel-dev/CordysCRM/issues/2685	issue-tracking
https://github.com/1Panel-dev/CordysCRM/issues/2686	exploitissue-tracking
https://github.com/1Panel-dev/CordysCRM/	product

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: 1.4.0 Affected: 1.4.1 cpe:2.3:a:1panel-dev:cordyscrm::::::::

Credits

liushaozhe (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16222",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T10:26:00.551051Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T10:26:14.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Third Party Endpoint"
          ],
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "liushaozhe (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T06:45:09.639Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-380044 | 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/380044"
        },
        {
          "name": "VDB-380044 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/380044/cti"
        },
        {
          "name": "CVE-2026-16222 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-16222"
        },
        {
          "name": "Submit #858043 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858043"
        },
        {
          "name": "Submit #858044 | 1Panel-dev CordysCRM 1.4.1  Server-Side Request Forgery (Duplicate)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858044"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2685"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2686"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-18T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-07-18T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-07-18T14:16:18.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-16222",
    "datePublished": "2026-07-19T06:45:09.639Z",
    "dateReserved": "2026-07-18T12:11:08.681Z",
    "dateUpdated": "2026-07-20T10:26:14.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-10567 (GCVE-0-2026-10567)

Vulnerability from cvelistv5 – Published: 2026-06-02 02:00 – Updated: 2026-06-02 13:11 X_Open Source

Title

1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting

Summary

A security vulnerability has been detected in 1Panel-dev CordysCRM up to 1.4.1. This impacts the function Save of the file src/main/java/cn/cordys/crm/system/service/ModuleFormService.java of the component ModuleFormController. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.7.0 will fix this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. Upgrading the affected component is recommended.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-02 13:10 UTC

CWE

CWE-79 - Cross Site Scripting
CWE-94 - Code Injection

Assigner

VulDB mitre root

References

9 references

URL	Tags
https://vuldb.com/vuln/367674	vdb-entrytechnical-description
https://vuldb.com/vuln/367674/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-10567	third-party-advisory
https://vuldb.com/submit/829316	third-party-advisory
https://github.com/1Panel-dev/CordysCRM/issues/2233	exploitissue-tracking
https://github.com/1Panel-dev/CordysCRM/pull/2356	issue-trackingpatch
https://github.com/1Panel-dev/CordysCRM/commit/c8…	patch
https://github.com/1Panel-dev/CordysCRM/releases/…	patch
https://github.com/1Panel-dev/CordysCRM/	product

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: 1.4.0 Affected: 1.4.1 Unaffected: 1.7.0 cpe:2.3:a:1panel-dev:cordyscrm::::::::

Credits

DaytimeHeaven (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10567",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T13:10:34.931269Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:11:19.461Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "ModuleFormController"
          ],
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "1.4.0"
            },
            {
              "status": "affected",
              "version": "1.4.1"
            },
            {
              "status": "unaffected",
              "version": "1.7.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "DaytimeHeaven (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in 1Panel-dev CordysCRM up to 1.4.1. This impacts the function Save of the file src/main/java/cn/cordys/crm/system/service/ModuleFormService.java of the component ModuleFormController. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.7.0 will fix this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. Upgrading the affected component is recommended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T02:00:15.087Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-367674 | 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/367674"
        },
        {
          "name": "VDB-367674 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/367674/cti"
        },
        {
          "name": "CVE-2026-10567 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-10567"
        },
        {
          "name": "Submit #829316 | https://github.com/1Panel-dev/CordysCRM CordysCRM v1.4.1 Stored XSS",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/829316"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2233"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2356"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-01T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-01T18:41:58.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-10567",
    "datePublished": "2026-06-02T02:00:15.087Z",
    "dateReserved": "2026-06-01T16:36:54.499Z",
    "dateUpdated": "2026-06-02T13:11:19.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-10514 (GCVE-0-2026-10514)

Vulnerability from cvelistv5 – Published: 2026-06-01 23:45 – Updated: 2026-06-02 15:45 X_Open Source

Title

1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting

Summary

A vulnerability has been found in 1Panel-dev CordysCRM up to 1.6.2. This affects an unknown function of the file backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 mitigates this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. It is suggested to upgrade the affected component.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

2.4 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

2.4 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-02 14:53 UTC

CWE

CWE-79 - Cross Site Scripting
CWE-94 - Code Injection

Assigner

VulDB mitre root

References

9 references

URL	Tags
https://vuldb.com/vuln/367596	vdb-entry
https://vuldb.com/vuln/367596/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-10514	third-party-advisory
https://vuldb.com/submit/828296	third-party-advisory
https://github.com/1Panel-dev/CordysCRM/issues/2229	exploitissue-tracking
https://github.com/1Panel-dev/CordysCRM/pull/2356	issue-trackingpatch
https://github.com/1Panel-dev/CordysCRM/commit/c8…	patch
https://github.com/1Panel-dev/CordysCRM/releases/…	patch
https://github.com/1Panel-dev/CordysCRM/	product

Impacted products

1 product

Vendor	Product	Version
1Panel-dev	CordysCRM	Affected: 1.6.0 Affected: 1.6.1 Affected: 1.6.2 Unaffected: 1.7.0 cpe:2.3:a:1panel-dev:cordyscrm::::::::

Credits

DaytimeHeaven (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-10514",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T14:53:38.174058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T15:45:28.904Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"
          ],
          "product": "CordysCRM",
          "vendor": "1Panel-dev",
          "versions": [
            {
              "status": "affected",
              "version": "1.6.0"
            },
            {
              "status": "affected",
              "version": "1.6.1"
            },
            {
              "status": "affected",
              "version": "1.6.2"
            },
            {
              "status": "unaffected",
              "version": "1.7.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "DaytimeHeaven (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in 1Panel-dev CordysCRM up to 1.6.2. This affects an unknown function of the file backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 mitigates this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. It is suggested to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 3.3,
            "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T23:45:12.138Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-367596 | 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/367596"
        },
        {
          "name": "VDB-367596 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/367596/cti"
        },
        {
          "name": "CVE-2026-10514 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-10514"
        },
        {
          "name": "Submit #828296 | https://github.com/1Panel-dev/CordysCRM CordysCRM v1.4.1 Stored XSS",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/828296"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/issues/2229"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/pull/2356"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/1Panel-dev/CordysCRM/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-01T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-01T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-01T07:54:59.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-10514",
    "datePublished": "2026-06-01T23:45:12.138Z",
    "dateReserved": "2026-06-01T05:49:54.439Z",
    "dateUpdated": "2026-06-02T15:45:28.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

22 vulnerabilities found for CordysCRM by 1Panel-dev

CVE-2026-76902 (GCVE-0-2026-76902)

CVE-2026-76901 (GCVE-0-2026-76901)

CVE-2026-76900 (GCVE-0-2026-76900)

CVE-2026-76899 (GCVE-0-2026-76899)

CVE-2026-63647 (GCVE-0-2026-63647)

CVE-2026-63646 (GCVE-0-2026-63646)

CVE-2026-52745 (GCVE-0-2026-52745)

CVE-2026-16223 (GCVE-0-2026-16223)

CVE-2026-16222 (GCVE-0-2026-16222)

CVE-2026-10567 (GCVE-0-2026-10567)

CVE-2026-10514 (GCVE-0-2026-10514)

CVE-2026-76899 (GCVE-0-2026-76899)

CVE-2026-76902 (GCVE-0-2026-76902)

CVE-2026-76900 (GCVE-0-2026-76900)

CVE-2026-76901 (GCVE-0-2026-76901)

CVE-2026-63647 (GCVE-0-2026-63647)

CVE-2026-63646 (GCVE-0-2026-63646)

CVE-2026-52745 (GCVE-0-2026-52745)

CVE-2026-16223 (GCVE-0-2026-16223)

CVE-2026-16222 (GCVE-0-2026-16222)

CVE-2026-10567 (GCVE-0-2026-10567)

CVE-2026-10514 (GCVE-0-2026-10514)