Threat database

CVE-2026-105389 is a medium severity vulnerability in feelec-yishu feelcrm-os version 1.0.0. It involves an unrestricted file upload issue in the UploadTicketFile endpoint, specifically in the UploadController.class.php file. The vulnerability arises from improper handling of the 'cmd' argument, allowing remote attackers to upload files without restriction. The exploit has been publicly disclosed, but no official response or patch has been provided by the vendor yet.

CVE-2026-105388 is a medium severity SQL injection vulnerability in feelcrm-os version 1.0.0. It affects the Member Endpoint component, specifically the index function in MemberController.class.php, allowing remote attackers to manipulate the group_id argument to execute SQL injection. The vulnerability has a publicly available exploit, and the vendor has not yet responded or issued a patch.

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-105290 is a server-side request forgery (SSRF) vulnerability in feelcrm-os version 1.0.0. It affects the getCurlData endpoint in the GoogleController.class.php file. An attacker can remotely manipulate the 'url' argument to make the server perform unauthorized requests. The vulnerability has a medium severity with a CVSS score of 6.9. The issue was reported early to the project but no response or patch has been provided yet. Exploit details have been publicly disclosed, but no known exploitation in the wild has been reported.

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer_form[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups[] causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.