A stored cross-site scripting vulnerability exists in the RequestParamTrimConfig.java component of 1Panel‑dev CordysCRM. The flaw exposes a function that can be supplied with unsanitized user input, allowing an attacker to inject arbitrary JavaScript into a victim’s browser session. The injected code can steal session cookies, deface pages, or perform malicious actions in the context of the authenticated user. This weakness is identified as CWE-79 and is also related to code‑generation errors indicated by CWE-94.

The vulnerability affects CordysCRM versions up to and including 1.6.2 from 1Panel‑dev. The affected code resides in backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. Versions 1.7.0 and later contain a patched implementation that removes the vulnerability.

The CVSS score of 4.8 suggests moderate, and the EPSS score is not available, indicating no publicly known exploitation rate yet. The issue is not listed in the CISA KEV catalog. Remote exploitation is possible, as the flaw can be triggered without local access by submitting crafted payloads to the vulnerable endpoint. If an attacker can deliver the payload, they may achieve a cross‑site scripting attack against users interacting with the application.