1panel-dev Cordyscrm vulnerabilities

• 1panel-dev cordyscrm CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import CVE-2026-108705 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints CVE-2026-108704 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push CVE-2026-108703 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test CVE-2026-108702 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort CVE-2026-108701 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title CVE-2026-108700 7.1 HighOctober 11, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints CVE-2026-108692 7.1 HighOctober 11, 2026
• 1panel-dev cordyscrm CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page` CVE-2026-76899 5.7 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}` CVE-2026-76902 5.0 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime CVE-2026-76900 6.8 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts CVE-2026-76901 5.8 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM SSE Notification Stream Hijack via `/sse/subscribe` CVE-2026-63647 9.3 CriticalSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users CVE-2026-63646 6.9 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM: Customer Public Pool Sorting Field SQL Injection CVE-2026-52745 5.3 MediumSeptember 18, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery CVE-2026-16223 5.3 MediumJuly 19, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery CVE-2026-16222 5.3 MediumJuly 19, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting CVE-2026-10567 5.1 MediumJune 2, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting CVE-2026-10514 4.8 MediumJune 1, 2026