CVE-2026-105388

A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/UploadController.class.php of the component UploadTicketFile Endpoint. Such manipulation of the argument cmd leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0 affecting the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the Department Search Endpoint component. Manipulation of the keyword argument leads to cross site scripting, and the attack can be initiated remotely. The exploit is publicly available and might be used; the project was informed but has not responded yet.

A vulnerability has been detected in feelcrm-os 1.0.0 (feelec-yishu project). It affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php in the getCurlData Endpoint component. Manipulation of the url argument can lead to server-side request forgery (SSRF). The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected is the htmlspecialchars_decode function of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the Create Customer Endpoint component. Manipulation of the customer_form[remark] argument results in cross site scripting, and the attack can be initiated remotely. The exploit has been made public and could be used; the project has not responded to the issue report.

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0 affecting the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the Crm Endpoint component. Manipulation of the redirect_url argument leads to cross site scripting, and the attack may be performed remotely. The exploit has been disclosed publicly and may be used; the project was informed but has not responded yet.

A flaw has been found in feelec-yishu feelcrm-os 1.0.0 affecting an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the getMemberByGroups Endpoint component. Manipulation of the groups[] argument causes sql injection, and the attack is possible remotely. The exploit has been published and may be used; the project was informed but has not responded yet.