CVE-2025-60828
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A fastjson deserialization vulnerability was discovered in WukongCRM-9.0-JAVA via the /OaExamine/setOaExamine interface. An attacker can remotely exploit this flaw to execute arbitrary code.
Risk Assessment
The risk includes full server compromise, customer data leakage, and system disruption.
Recommendation
Immediately update WukongCRM to the latest version and apply security patches for the fastjson library.
Other vulnerabilities in WukongCRM
See all- CVE-2026-2141Medium
A security flaw in WukongCRM up to version 11.3.3 affects the URL Handler component in PermissionServiceImpl.java. Manipulation leads to improper authorization, allowing remote exploitation. A public exploit is available, and the vendor has not responded.
- CVE-2025-8852Medium
In WuKongOpenSource WukongCRM 11.0, a vulnerability in the /adminFile/upload file of the API Response Handler component leads to information exposure through error messages. The attack can be performed remotely, and exploit details are publicly available.
- CVE-2025-5521Medium
A cross-site request forgery (CSRF) vulnerability was found in WuKongOpenSource WukongCRM 9.0 in the file /system/user/updataPassword. The attack can be launched remotely, and exploit details have been publicly disclosed.
Original NVD description (English source)
WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS