Product by 1Panel-dev

    1Panel-dev CordysCRM

    18 known vulnerabilities in 1Panel-dev CordysCRM (1Panel-dev), 0 of them actively exploited (CISA KEV).

    Key figures

    18

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in 1Panel-dev CordysCRM (1Panel-dev)
    CriticalCVE-2026-63647

    CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

    		—
    MediumCVE-2026-63646

    CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

    		—
    MediumCVE-2026-76900

    CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

    		6.8
    HighCVE-2026-108700

    1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

    		6.5
    HighCVE-2026-108692

    1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

    		6.5
    MediumCVE-2026-76901

    1Panel-dev CordysCRM: Authorization Bypass Through User-Controlled Key

    		5.8
    MediumCVE-2026-76899

    CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

    		5.7
    MediumCVE-2026-16222

    1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery

    		6.3
    MediumCVE-2026-16223

    1Panel-dev CordysCRM: Server-Side Request Forgery (SSRF)

    		6.3
    MediumCVE-2026-52745

    CordysCRM: Customer Public Pool Sorting Field SQL Injection

    		5.3
    MediumCVE-2026-108702

    CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test

    		4.3
    MediumCVE-2026-108704

    CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints

    		4.3
    MediumCVE-2026-108703

    CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push

    		5.4
    MediumCVE-2026-108705

    CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import

    		4.3
    MediumCVE-2026-108701

    1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort

    		4.3
    MediumCVE-2026-76902

    1Panel-dev CordysCRM: Missing Authentication for Critical Function

    		5.0
    MediumCVE-2026-10567

    1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting

    		3.5
    MediumCVE-2026-10514

    1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting

    		2.4

    All products by 1Panel-dev