Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-105291: feelec-yishu/feelcrm-os lets attackers run scripts in browsers
CVE-2026-105291 · published 14 days ago
Summary
The Department Search feature in feelcrm-os version 1.0.0 does not properly clean the text you type when searching. An attacker can send a specially crafted search term that makes a web page run their own code in the browser of anyone who views the results, which could be used to steal information or hijack a session. Apply the vendor’s fix or disable the search function until it is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| feelec-yishu | feelcrm-os | 1.0.0 |
Original advisory text
feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting
A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
CWE-94Code Injection
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Track software like this
Free during beta