CVE-2026-105291: feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting
A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can initiate the attack remotely without privileges by manipulating the keyword argument sent to the Department Search Endpoint. Exploitation requires user interaction, consistent with the UI:R vector.
Is public exploit material available?
Yes. The available information states that a public exploit exists and might be used.
Which deployments are known to be affected?
The issue is identified in feelec-yishu feelcrm-os version 1.0.0, specifically in GroupController::index in App/Feelcrm/Index/Controller/GroupController.class.php. The provided data does not identify a fixed version or workaround.
Has the vendor addressed the issue?
The project was notified through an issue report but had not responded at the time of the report. No vendor patch or remediation status is provided.