CVE-2026-105289

Published: Ott 05, 2026 Last Modified: Ott 05, 2026

ExploitDB:

Other exploit source:

Google Dorks:

LOW 2,0

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: passive

Confidentiality: N/A

Integrity: N/A

Availability: N/A

LOW 3,5

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: required

Scope: unchanged

Confidentiality: none

Integrity: low

Availability: none

MEDIUM 4,0

Source: [email protected]

Access Vector: network

Access Complexity: low

Authentication: single

Confidentiality: none

Integrity: partial

Availability: none

Description

AI Translation Available

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer_form[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.