CVE-2026-10771

HighCVSS 7.3

Published: 03/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

Server-Side Request Forgery (SSRF) vulnerability in the RestTemplate.getForEntity function in RestTemplateUtil.java in crmeb_java 1.4. An attacker can remotely manipulate the URL argument in the base64 Qrcode endpoint, leading to unauthorized server requests.

Risk Assessment

Risk of unauthorized requests to internal network resources, potentially leading to data leakage or further system compromise.

Recommendation

Upgrade to a newer version of crmeb_java or apply temporary mitigations such as URL validation in the endpoint.

Other vulnerabilities in crmeb_java

CVE-2024-28714High
SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.

Original NVD description (English source)

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.