CVE-2026-105287 feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

CVE-2026-105287

A SQL injection vulnerability exists in feelec-yishu feelcrm-os 1.0.0 within the getMemberByGroups endpoint. The flaw is caused by the manipulation of the groups[] argument in an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php . This vulnerability can be ex...