rootpwn

medium · CVSS v3 5.3 · EPSS 0.00026

CVE-2026-52745

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior t…

Description

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.

Scores

Severity
medium
CVSS v2
5.8
CVSS v3
5.3
CVSS v4
—
EPSS
0.00026

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-11539

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to an authentication bypass in the SOAP/JMX connector, allowing attackers to gain unauthorized access to JMX services and potentially expose sensitive configuration data. The flaw is relevant for organizations running these versions in production environments.

View analysis

medium

CVE-2026-11540

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to a remote information disclosure via the FileTransfer servlet. An attacker can retrieve sensitive file system details without authentication. This flaw can aid reconnaissance or further attacks.

View analysis

medium

CVE-2026-11548

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.

View analysis