CordysCRM — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in CordysCRM, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-76899	CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page` CWE-89	5.7	Medium	2026-09-18
CVE-2026-76902	CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}` CWE-306	5.0	Medium	2026-09-18
CVE-2026-76900	CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime CWE-918	6.8	Medium	2026-09-18
CVE-2026-76901	CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts CWE-639	5.8	Medium	2026-09-18
CVE-2026-63647	CordysCRM SSE Notification Stream Hijack via `/sse/subscribe` CWE-306	9.3	Critical	2026-09-18
CVE-2026-63646	CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users CWE-200	6.9	Medium	2026-09-18
CVE-2026-52745	CordysCRM: Customer Public Pool Sorting Field SQL Injection CWE-89	5.3	Medium	2026-09-18
CVE-2026-16223	1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery CWE-918	6.3	Medium	2026-07-19
CVE-2026-16222	1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery CWE-918	6.3	Medium	2026-07-19
CVE-2026-10567	1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting CWE-79	3.5	Low	2026-06-02
CVE-2026-10514	1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting CWE-79	2.4	Low	2026-06-01

All 11 known CVE vulnerabilities affecting CordysCRM with full Chinese analysis, references, and POCs where available.