CVE-2026-105289: feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting
A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerform[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are confirmed affected?
The reported affected version is feelec-yishu feelcrm-os 1.0.0. The issue is in the Create Customer endpoint, specifically processing of the customer_form[remark] argument.
What access and user interaction does exploitation require?
An attacker can initiate the attack remotely, but the supplied severity vector indicates low privileges are required and user interaction is required. Successful exploitation can affect integrity, while no confidentiality or availability impact is listed.
Is exploit code available?
Yes. The report states that a public exploit has been released and could be used.
Is a patch or workaround available?
No patch or workaround is provided in the available data. The project was notified through an issue report but had not responded at the time of publication.