agentprime: 1panel-dev-cordyscrmEvery new CVE for 1panel-dev-cordyscrm.https://agentprime.io/CVE-2026-108705: CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/importhttps://agentprime.io/advisories/CVE-2026-108705/https://agentprime.io/advisories/CVE-2026-108705/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 01:12:30 GMTCVECVE-2026-108704: CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpointshttps://agentprime.io/advisories/CVE-2026-108704/https://agentprime.io/advisories/CVE-2026-108704/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 01:12:29 GMTCVECVE-2026-108703: CordysCRM through 1.9.3 Missing Authorization via /approval-resource/pushhttps://agentprime.io/advisories/CVE-2026-108703/https://agentprime.io/advisories/CVE-2026-108703/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 01:12:29 GMTCVECVE-2026-108702: CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Testhttps://agentprime.io/advisories/CVE-2026-108702/https://agentprime.io/advisories/CVE-2026-108702/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 01:12:28 GMTCVECVE-2026-108701: 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sorthttps://agentprime.io/advisories/CVE-2026-108701/https://agentprime.io/advisories/CVE-2026-108701/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 01:12:27 GMTCVECVE-2026-108700: 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-titlehttps://agentprime.io/advisories/CVE-2026-108700/https://agentprime.io/advisories/CVE-2026-108700/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 01:12:27 GMTCVECVE-2026-108692: 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpointshttps://agentprime.io/advisories/CVE-2026-108692/https://agentprime.io/advisories/CVE-2026-108692/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 01:12:26 GMTCVECVE-2026-76899: CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`https://agentprime.io/advisories/CVE-2026-76899/https://agentprime.io/advisories/CVE-2026-76899/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:58:47 GMTCVECVE-2026-76902: CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`https://agentprime.io/advisories/CVE-2026-76902/https://agentprime.io/advisories/CVE-2026-76902/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:57:50 GMTCVECVE-2026-76900: CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtimehttps://agentprime.io/advisories/CVE-2026-76900/https://agentprime.io/advisories/CVE-2026-76900/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:56:53 GMTCVECVE-2026-76901: CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accountshttps://agentprime.io/advisories/CVE-2026-76901/https://agentprime.io/advisories/CVE-2026-76901/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:55:16 GMTCVECVE-2026-63647: CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`https://agentprime.io/advisories/CVE-2026-63647/https://agentprime.io/advisories/CVE-2026-63647/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:53:51 GMTCVEcriticalCVE-2026-63646: CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Usershttps://agentprime.io/advisories/CVE-2026-63646/https://agentprime.io/advisories/CVE-2026-63646/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:52:06 GMTCVECVE-2026-52745: CordysCRM: Customer Public Pool Sorting Field SQL Injectionhttps://agentprime.io/advisories/CVE-2026-52745/https://agentprime.io/advisories/CVE-2026-52745/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:51:17 GMTCVECVE-2026-16223: 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-16223/https://agentprime.io/advisories/CVE-2026-16223/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 19 Jul 2026 07:15:09 GMTCVECVE-2026-16222: 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-16222/https://agentprime.io/advisories/CVE-2026-16222/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 19 Jul 2026 06:45:09 GMTCVECVE-2026-10567: 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scriptinghttps://agentprime.io/advisories/CVE-2026-10567/https://agentprime.io/advisories/CVE-2026-10567/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 02:00:15 GMTCVECVE-2026-10514: 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scriptinghttps://agentprime.io/advisories/CVE-2026-10514/https://agentprime.io/advisories/CVE-2026-10514/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Jun 2026 23:45:12 GMTCVE