Description
A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-05
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Cross-site scripting via the redirect_url parameter
Action: Assess Impact
AI Analysis

Impact

Uncontrolled redirect_url input in the IndexController::index function of the Crm Endpoint component permits injection of arbitrary script that will be executed in the victim's browser. The resulting client‑side compromise can expose session data, deface pages, or conduct phishing attacks. This weakness is linked to CWE‑79 and CWE‑94.

Affected Systems

The vulnerability affects feelec‑yishu feelcrm‑os version 1.0.0, particularly the file App/ThinkPHP/Common/functions.php used by the Crm Endpoint controller.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate severity, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is not available, but the attack can be carried out remotely by tampering with the redirect_url request parameter to leak or manipulate client‑side data.

Generated by OpenCVE AI on October 5, 2026 at 11:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Validate redirect_url input to accept only whitelisted, trustworthy URLs
  • Encode or escape all user‑supplied data before rendering it in the response
  • Restrict access to the index endpoint by requiring authentication or limiting exposure

Generated by OpenCVE AI on October 5, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 05 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting
First Time appeared Feelec-yishu
Feelec-yishu feelcrm-os
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:feelec-yishu:feelcrm-os:*:*:*:*:*:*:*:*
Vendors & Products Feelec-yishu
Feelec-yishu feelcrm-os
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Feelec-yishu Feelcrm-os
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-05T10:00:10.985Z

Reserved: 2026-10-04T22:44:20.179Z

Link: CVE-2026-105288

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-05T10:16:41.713

Modified: 2026-10-05T10:16:41.713

Link: CVE-2026-105288

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-05T11:30:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')