PT-2026-95664

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.7.4 Description ShiroFilter configures the endpoints '/attachment/preview/id' and '/pic/preview/id' as anonymous. Both routes call the getResource function in AttachmentService, which performs a primary-key lookup...