EUVD-2026-96703

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

CVE-2026-108705

CordysCRM through version 1.9.3 is vulnerable to a missing authorization flaw in the POST /custom-form/data/import endpoint. This vulnerability allows authenticated, low-privileged users to import data into any custom form by specifying a customFormId . Attackers can upload Excel files using impo...