1Panel-dev CordysCRM

• CVE-2026-108705 Medium 4.3 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import 0.2%
• CVE-2026-108704 Medium 4.3 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints 0.2%
• CVE-2026-108703 Medium 5.4 CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push 0.2%
• CVE-2026-108702 Medium 4.3 CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test 0.2%
• CVE-2026-108701 Medium 4.3 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort 0.2%
• CVE-2026-108700 Medium 6.5 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title 0.2%
• CVE-2026-108692 Medium 6.5 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints 0.2%
• CVE-2026-76899 Medium 5.7 CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page` 0.4%
• CVE-2026-76902 Medium 5.0 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}` 0.3%
• CVE-2026-76900 Medium 6.8 CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime 0.5%
• CVE-2026-76901 Medium 5.8 CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts 0.4%
• CVE-2026-63647 Critical 9.3 CordysCRM SSE Notification Stream Hijack via `/sse/subscribe` 0.5%
• CVE-2026-63646 Medium 6.9 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users 0.7%
• CVE-2026-52745 Medium 5.3 CordysCRM: Customer Public Pool Sorting Field SQL Injection 0.3%
• CVE-2026-16223 Medium 6.3 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery 0.4%
• CVE-2026-16222 Medium 6.3 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery 0.4%
• CVE-2026-10567 Low 3.5 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting 0.2%
• CVE-2026-10514 Low 2.4 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting 0.3%