CordysCRM 代码注入漏洞
摘要
CordysCRM 代码注入漏洞
正文
漏洞基本信息 漏洞名称 CordysCRM 代码注入漏洞 厂商 飞致云 CNNVD编号 CNNVD-202606-582 危害等级 —— CVE编号 CVE-2026-10567 漏洞类型 代码注入 收录时间 2026-06-02 更新时间 2026-06-03 漏洞简介 FIT2CLOUD CordysCRM是中国飞致云（FIT2CLOUD）公司的一个客户关系管理系统。 CordysCRM 1.4.1及之前版本存在代码注入漏洞，该漏洞源于ModuleFormController组件中文件src/main/java/cn/cordys/crm/system/service/ModuleFormService.java的Save函数问题，可能导致跨站脚本攻击。 参考网址 来源:github.com 链接: https://github.com/1Panel-dev/CordysCRM/ 来源:github.com 链接: https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce 来源:github.com 链接: https://github.com/1Panel-dev/CordysCRM/issues/2233 来源:github.com 链接: https://github.com/1Panel-dev/CordysCRM/pull/2356 来源:github.com 链接: https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0 来源:vuldb.com 链接: https://vuldb.com/cve/CVE-2026-10567 来源:vuldb.com 链接: https://vuldb.com/submit/829316 来源:vuldb.com 链接: https://vuldb.com/vuln/367674 来源:vuldb.com 链接: https://vuldb.com/vuln/367674/cti 官方补丁 暂无
标签
- cnnvd
- cnnvd:CNNVD-202606-582
- cve:CVE-2026-10567
- vul_type:0
扩展字段
{
"affected_vendor": "飞致云",
"cnnvd_code": "CNNVD-202606-582",
"create_time": "2026-06-03",
"cve_code": "CVE-2026-10567",
"detailed_publish_time": "2026-06-02 00:00:00",
"detailed_update_time": "2026-06-03 00:00:00",
"hazard_level": 4,
"is_official": 1,
"publish_time": "2026-06-02",
"refer_url": "来源:github.com\r\n链接:https://github.com/1Panel-dev/CordysCRM/\r\n\r\n来源:github.com\r\n链接:https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce\r\n\r\n来源:github.com\r\n链接:https://github.com/1Panel-dev/CordysCRM/issues/2233\r\n\r\n来源:github.com\r\n链接:https://github.com/1Panel-dev/CordysCRM/pull/2356\r\n\r\n来源:github.com\r\n链接:https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0\r\n\r\n来源:vuldb.com\r\n链接:https://vuldb.com/cve/CVE-2026-10567\r\n\r\n来源:vuldb.com\r\n链接:https://vuldb.com/submit/829316\r\n\r\n来源:vuldb.com\r\n链接:https://vuldb.com/vuln/367674\r\n\r\n来源:vuldb.com\r\n链接:https://vuldb.com/vuln/367674/cti",
"update_time": "2026-06-03",
"vendor": "1004815",
"vul_desc": "FIT2CLOUD CordysCRM是中国飞致云（FIT2CLOUD）公司的一个客户关系管理系统。\r\nCordysCRM 1.4.1及之前版本存在代码注入漏洞，该漏洞源于ModuleFormController组件中文件src/main/java/cn/cordys/crm/system/service/ModuleFormService.java的Save函数问题，可能导致跨站脚本攻击。",
"vul_type": "0",
"vul_type_name": "代码注入"
}