Advisories · Technology
1Panel-dev CordysCRM.
Every CVE that names 1Panel-dev CordysCRM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
- 1Panel-dev CordysCRM
- Broken access control
- CVSS 5.3 Medium
CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints
- 1Panel-dev CordysCRM
- Broken access control
- CVSS 5.3 Medium
CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push
- 1Panel-dev CordysCRM
- Broken access control
- CVSS 5.3 Medium
CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test
- 1Panel-dev CordysCRM
- Broken access control
- CVSS 5.3 Medium
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
- 1Panel-dev CordysCRM
- Broken access control
- CVSS 7.1 High
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
- 1Panel-dev CordysCRM
- Broken access control
- CVSS 7.1 High
1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
- 1Panel-dev CordysCRM
- Broken access control
- CVSS 5.7 Medium
CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
- 1Panel-dev CordysCRM
- SQL injection
- CWE-1284
- CVSS 5.0 Medium
CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`
- 1Panel-dev CordysCRM
- Authentication bypass
- Broken access control
- CVSS 6.8 Medium
CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
- 1Panel-dev CordysCRM
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts
- 1Panel-dev CordysCRM
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
- 1Panel-dev CordysCRM
- Authentication bypass
- Broken access control
- CVSS 6.9 Medium
CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users
- 1Panel-dev CordysCRM
- Information disclosure
- CVSS 5.3 Medium
CordysCRM: Customer Public Pool Sorting Field SQL Injection
- 1Panel-dev CordysCRM
- SQL injection
- CVSS 5.3 Medium
1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery
- 1Panel-dev CordysCRM
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
- 1Panel-dev CordysCRM
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting
- 1Panel-dev CordysCRM
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting
- 1Panel-dev CordysCRM
- Cross-site scripting (XSS)
- Code injection