| 제목 | https://github.com/1Panel-dev/CordysCRM CordysCRM v1.4.1 stored XSS |
|---|
| 설명 | A stored cross-site scripting (XSS) vulnerability exists in the CustomerFollowRecordController component of CordysCRM v1.4.1. This vulnerability stems from the add() method's failure to adequately validate or encode the content parameter when handling requests to save customer follow-up records. A remote attacker could exploit the /account/follow/record/add interface to submit malicious JavaScript code. When the user clicks to view customer follow-up records, the malicious script will execute in their browser environment. |
|---|
| 원천 | ⚠️ https://github.com/1Panel-dev/CordysCRM/issues/2239 |
|---|
| 사용자 | DaytimeHeaven (UID 96977) |
|---|
| 제출 | 2026. 05. 14. AM 09:09 (5 개월 ago) |
|---|
| 모더레이션 | 2026. 06. 02. PM 03:50 (19 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 367674 [1Panel-dev CordysCRM 까지 1.4.1 ModuleFormController ModuleFormService.java save description 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|