CVE-2026-10514
Low
Description
A vulnerability has been found in 1Panel-dev CordysCRM up to 1.6.2. This affects an unknown function of the file backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.0 mitigates this issue. The identifier of the patch is c87682afa8df79853299f75489c9d333f7bc5fce. It is suggested to upgrade the affected component.
SeverityLow
CVSS2.4
Exploit probability—
Product1panel-dev Cordyscrm
PublishedJun 2, 2026
First seenJun 2, 2026
Weakness typeCWE-79Cross-site scripting (XSS)CWE-94Code injection
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 1panel-dev cordyscrm | 1.6.0, 1.6.1, 1.6.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.