CVE-2026-10205
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability was found in MetaCRM 6.4.0 by Metasoft 美特软件 in the file develop/systparam/softlogo/upload.jsp. An unknown function allows unrestricted file upload. The attack can be performed remotely and the exploit has been published.
Risk Assessment
An attacker can upload a malicious file to the server, potentially leading to system compromise or data theft.
Recommendation
Immediately block access to the upload.jsp file and implement file upload validation mechanisms.
Other vulnerabilities in MetaCRM
See all- CVE-2026-16324High
Vulnerability in Metasoft 美特软件 MetaCRM up to version 6.4.0 Beta06. An unknown function in the file /business/qnaire/upload.jsp allows unrestricted file upload via the File argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-15514High
A SQL injection vulnerability has been identified in Metasoft MetaCRM up to version 6.4.0 Beta06 within the PHPRPC Remote Call Interface component. The flaw exists in the file /customizemt/xkq/rpc.jsp, where the RPCService.query function improperly handles the phprpc_args argument. The attack can be executed remotely, and a public exploit is available.
Original NVD description (English source)
A security vulnerability has been detected in Metasoft 美特软件 MetaCRM 6.4.0. The impacted element is an unknown function of the file develop/systparam/softlogo/upload.jsp. Such manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.