PT-2026-95642

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.7.0 Description The POST '/account-pool/page' endpoint allows an authenticated user with MODULE SETTING:UPDATE permissions to inject a crafted sort.name value into a dynamic SQL ORDER BY expression due to a lack o...