1Panel-dev CordysCRM vulnerabilities

19 published CVEs name 1Panel-dev CordysCRM among the affected products.

Newest CVEs

CVE-2026-126496
1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id}
1Panel-dev · CordysCRM
Medium5.3
CVE-2026-108705
CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
1Panel-dev · CordysCRM
Medium5.3
CVE-2026-108704
CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints
1Panel-dev · CordysCRM
Medium5.3
CVE-2026-108703
CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push
1Panel-dev · CordysCRM
Medium5.3
CVE-2026-108702
CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test
1Panel-dev · CordysCRM
Medium5.3
CVE-2026-108701
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
1Panel-dev · CordysCRM
Medium5.3
CVE-2026-108700
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
1Panel-dev · CordysCRM
High7.1
CVE-2026-108692
1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
1Panel-dev · CordysCRM
High7.1
CVE-2026-76899
CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
1Panel-dev · CordysCRM
Medium5.7
CVE-2026-76902
CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`
1Panel-dev · CordysCRM
Medium5.0