Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

CordysCRM — Vulnerabilities & Security Advisories 19

All 19 CVE vulnerabilities found in CordysCRM, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security advisories and vulnerability reports specifically for the CordysCRM customer relationship management platform developed by Cordys, focusing primarily on server-side flaws and authentication bypass issues. The collection encompasses a comprehensive history of disclosed weaknesses ranging from early 2010s releases through the most recent security bulletins, capturing critical remote code execution risks, cross-site scripting vectors, and privilege escalation vulnerabilities found across various software versions. Readers can utilize this resource to track the official security advisories issued by the vendor, analyze the prevalence and impact of specific weakness classes within enterprise CRM systems, or review the complete vulnerability timeline to assess the long-term security posture of the product. By centralizing these fragmented data points, the page offers a clear view of how the software has evolved regarding its defensive capabilities and the recurring attack patterns targeted at its architecture. This centralized repository serves as a practical reference for security analysts, system administrators, and auditors who need to verify the presence of known defects in their deployed environments without navigating multiple disparate sources or waiting for individual vendor communications. The data presented here supports proactive risk management strategies and helps organizations maintain compliance with security standards by ensuring all historical and current threats are properly documented and addressed.

Vendor: 1Panel-dev

CVE ID Title CVSS Severity Published
CVE-2026-126496 1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id} CWE-639 4.3 Medium 2026-11-11
CVE-2026-108704 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints CWE-639 4.3 Medium 2026-10-11
CVE-2026-108705 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import CWE-862 4.3 Medium 2026-10-11
CVE-2026-108703 CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push CWE-862 5.4 Medium 2026-10-11
CVE-2026-108701 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort CWE-862 4.3 Medium 2026-10-11
CVE-2026-108702 CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test CWE-862 4.3 Medium 2026-10-11
CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title CWE-862 6.5 Medium 2026-10-11
CVE-2026-108692 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints CWE-862 6.5 Medium 2026-10-11
CVE-2026-76899 CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page` CWE-89 5.7 Medium 2026-09-18
CVE-2026-76902 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}` CWE-306 5.0 Medium 2026-09-18
CVE-2026-76900 CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime CWE-918 6.8 Medium 2026-09-18
CVE-2026-76901 CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts CWE-639 5.8 Medium 2026-09-18
CVE-2026-63647 CordysCRM SSE Notification Stream Hijack via `/sse/subscribe` CWE-306 9.3 Critical 2026-09-18
CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users CWE-200 6.9 Medium 2026-09-18
CVE-2026-52745 CordysCRM: Customer Public Pool Sorting Field SQL Injection CWE-89 5.3 Medium 2026-09-18
CVE-2026-16223 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery CWE-918 6.3 Medium 2026-07-19
CVE-2026-16222 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery CWE-918 6.3 Medium 2026-07-19
CVE-2026-10567 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting CWE-79 3.5 Low 2026-06-02
CVE-2026-10514 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting CWE-79 2.4 Low 2026-06-01

All 19 known CVE vulnerabilities affecting CordysCRM with full Chinese analysis, references, and POCs where available.