CVE-2026-105288: feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting
A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirecturl leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or local access?
No privileges are required, and the attack can be performed remotely. Successful exploitation requires user interaction.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
How can I identify whether my deployment is in the stated affected scope?
The reported affected version is feelec-yishu feelcrm-os 1.0.0. The issue is associated with the Crm Endpoint's IndexController::index function in App/ThinkPHP/Common/functions.php, where redirect_url is manipulated.