Login Request a demo
Low severity · published Jun 1, 2026
CVE-2026-10514
1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting
2.4
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in 1Panel-dev CordysCRM up to 1.6.2. This affects an unknown function of the file backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 mitigates this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. It is suggested to upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CordysCRM · 1Panel-dev
1.6.0; 1.6.1; 1.6.2 · source: vendor
Affected product
CO
CordysCRM
1Panel-dev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10514
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10514
github.com
https://github.com/1Panel-dev/CordysCRM/
github.com
https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce
github.com
https://github.com/1Panel-dev/CordysCRM/issues/2229
github.com
https://github.com/1Panel-dev/CordysCRM/pull/2356
github.com
https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0
vuldb.com
https://vuldb.com/cve/CVE-2026-10514
More from CordysCRM
9.3
CVE-2026-63647
CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
6.9
CVE-2026-63646
CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users
6.8
CVE-2026-76900
CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
6.5
CVE-2026-108700
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
6.5
CVE-2026-108692
1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints