CVE-2026-105288 feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting

A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirecturl leads to cross site scripting. The atta...

CVE-2026-105287

A SQL injection vulnerability exists in feelec-yishu feelcrm-os 1.0.0 within the getMemberByGroups endpoint. The flaw is caused by the manipulation of the groups[] argument in an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php . This vulnerability can be ex...

CVE-2026-105287 feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

CVE-2026-105287 feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

EUVD-2026-92386

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

zephyr

ElasticSearch index map examples This directory contains ElasticSearch data store index map examples for use by uploadtestresultses.py script for Twister JSON reports upload. An index map file allows to create destination index files on ElasticSearch server with explicit scheme having all require...

Malicious code in css-txedrf-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d70c660ff3138360df0239fc6ef3db7beaca61ca069bc2d108ed893c68acb63 thunderboltRegistry.js executes an IIFE at require time that runs OS reconnaissance commands id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts v...

MAL-2026-17558 Malicious code in css-txedrf-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d70c660ff3138360df0239fc6ef3db7beaca61ca069bc2d108ed893c68acb63 thunderboltRegistry.js executes an IIFE at require time that runs OS reconnaissance commands id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts v...

CVE-2026-105290: Server-Side Request Forgery (SSRF)

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

PT-2026-106176

Name of the Vulnerable Software and Affected Versions feelec-yishu feelcrm-os version 1.0.0 Description A remote SQL injection exists in the Member Endpoint component. The issue occurs within the index function of the file App/Feelcrm/Index/Controller/MemberController.class.php when the group id...

PT-2026-106219

Name of the Vulnerable Software and Affected Versions Chainguard Academy edu integrate-platform-docs composite GitHub Action versions from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff through commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 Description Improper neutralization of special element...

PT-2026-106232

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.10.3 langflow-base versions prior to 0.10.3 lfx versions prior to 1.10.3 Description An issue exists in the MCP stdio transport where the software executes commands and arguments provided in an MCP server...

CVE-2026-105289: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

PT-2026-104799

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

PT-2026-104795

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

PT-2026-104797

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer formremark...

PT-2026-104798

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

PT-2026-106203

Name of the Vulnerable Software and Affected Versions feelec-yishu feelcrm-os version 1.0.0 Description An issue in the UploadTicketFile endpoint within the file App/Feelcrm/Crm/Controller/UploadController.class.php allows for unrestricted file upload. This occurs when the cmd argument is...

CVE-2026-105767: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy edu from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3 allows an actor who controls the projectid...

CVE-2026-105691: Improper Neutralization of Special Elements used in an OS Command

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through childprocess.exec. A user who can edit a file can store shell metacharacters...