CVE-2026-79425

CRMEB v6.0.0 contains an authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component. An attacker with a valid account can send a crafted POST request to scan internal network resources, potentially exposing sensitive endpoints. The CNA-assigned CVSS 3.1 score i...