CVE-2026-105288
MediumCVSS 4.3Summary
A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0 affecting the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the Crm Endpoint component. Manipulation of the redirect_url argument leads to cross site scripting, and the attack may be performed remotely. The exploit has been disclosed publicly and may be used; the project was informed but has not responded yet.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially hijacking sessions or credentials. The public availability of the exploit increases the risk of exploitation.
Recommendation
Given the project's lack of response, consider applying your own patches or restricting access to the application. Validate and encode the redirect_url parameter.
Other vulnerabilities in feelcrm-os
See all- CVE-2026-105291Medium
A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0 affecting the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the Department Search Endpoint component. Manipulation of the keyword argument leads to cross site scripting, and the attack can be initiated remotely. The exploit is publicly available and might be used; the project was informed but has not responded yet.
- CVE-2026-105290High
A vulnerability has been detected in feelcrm-os 1.0.0 (feelec-yishu project). It affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php in the getCurlData Endpoint component. Manipulation of the url argument can lead to server-side request forgery (SSRF). The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-105289Low
A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected is the htmlspecialchars_decode function of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the Create Customer Endpoint component. Manipulation of the customer_form[remark] argument results in cross site scripting, and the attack can be initiated remotely. The exploit has been made public and could be used; the project has not responded to the issue report.
- CVE-2026-105287Medium
A flaw has been found in feelec-yishu feelcrm-os 1.0.0 affecting an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the getMemberByGroups Endpoint component. Manipulation of the groups[] argument causes sql injection, and the attack is possible remotely. The exploit has been published and may be used; the project was informed but has not responded yet.
Original NVD description (English source)
A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS