1Panel-dev CordysCRM vulnerabilities

Newest CVEs

• CVE-2026-108705

  CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import

  1Panel-dev · CordysCRM

  Medium5.3
• CVE-2026-108704

  CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints

  1Panel-dev · CordysCRM

  Medium5.3
• CVE-2026-108703

  CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push

  1Panel-dev · CordysCRM

  Medium5.3
• CVE-2026-108702

  CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test

  1Panel-dev · CordysCRM

  Medium5.3
• CVE-2026-108701

  1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort

  1Panel-dev · CordysCRM

  Medium5.3
• CVE-2026-108700

  1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

  1Panel-dev · CordysCRM

  High7.1
• CVE-2026-108692

  1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

  1Panel-dev · CordysCRM

  High7.1
• CVE-2026-76899

  CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

  1Panel-dev · CordysCRM

  Medium5.7
• CVE-2026-76902

  CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

  1Panel-dev · CordysCRM

  Medium5.0
• CVE-2026-76900

  CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

  1Panel-dev · CordysCRM

  Medium6.8