CVE-2026-105288: Cross Site Scripting in feelec-yishu feelcrm-os
Description
CVE-2026-105288 is a cross-site scripting (XSS) vulnerability in feelcrm-os version 1.0.0. The flaw exists in the IndexController::index function within the App/ThinkPHP/Common/functions.php file, specifically in the handling of the redirect_url argument. This vulnerability allows remote attackers to inject malicious scripts. The issue has been publicly disclosed, but the vendor has not yet responded or provided a fix.
CVSS v4.0
Score 5.3medium
Affected software
feelec-yishu
feelcrm-os
pkg:github/feelec-yishu/feelcrm-oscpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-105288 affects feelcrm-os 1.0.0 in the IndexController::index function of the App/ThinkPHP/Common/functions.php file. Improper handling of the redirect_url parameter leads to a cross-site scripting (XSS) vulnerability. This can be exploited remotely by an attacker to execute arbitrary scripts in the context of the affected application. The vulnerability was reported early to the project but remains unpatched. Public exploit details have been disclosed.
Potential Impact
Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks, potentially leading to session hijacking, defacement, or redirection of users to malicious sites. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate risk with no privileges required and user interaction needed.
Mitigation Recommendations
No official fix or patch is currently available from the vendor. Users should monitor the vendor's communications for updates. Until a patch is released, avoid using the affected version 1.0.0 in untrusted environments or implement web application firewalls (WAFs) to detect and block XSS attempts targeting the redirect_url parameter.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-04T22:44:20.179Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac379932cdf04f656ef859d
Added to database: 10/05/2026, 10:18:59 UTC
Last enriched: 10/05/2026, 10:33:12 UTC
Last updated: 10/05/2026, 10:33:56 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.