What’s Vulnerable › Products

1Panel-dev CordysCRM vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.

Check whether your 1Panel-dev CordysCRM version is affected

Latest 1Panel-dev CordysCRM vulnerabilities

• CVE-2026-108705 — CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import (CVSS 4.3)
• CVE-2026-108704 — CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints (CVSS 4.3)
• CVE-2026-108703 — CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push (CVSS 5.4)
• CVE-2026-108702 — CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test (CVSS 4.3)
• CVE-2026-108701 — 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort (CVSS 4.3)
• CVE-2026-108700 — 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title (CVSS 6.5)
• CVE-2026-108692 — 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints (CVSS 6.5)
• CVE-2026-76902 — CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}` (CVSS 5.0)
• CVE-2026-76901 — CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts (CVSS 5.8)
• CVE-2026-76900 — CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime (CVSS 6.8)
• CVE-2026-76899 — CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page` (CVSS 5.7)
• CVE-2026-63647 — CordysCRM SSE Notification Stream Hijack via `/sse/subscribe` (CVSS 9.3)
• CVE-2026-63646 — CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users (CVSS 6.9)
• CVE-2026-52745 — CordysCRM: Customer Public Pool Sorting Field SQL Injection (CVSS 5.3)
• CVE-2026-16223 — 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery (CVSS 6.3)
• CVE-2026-16222 — 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery (CVSS 6.3)
• CVE-2026-10567 — 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting (CVSS 3.5)
• CVE-2026-10514 — 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting (CVSS 2.4)