CVE-2026-105289
Received Received - Intake

Cross-Site Scripting in feelcrm-os Customer Form

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: VulDB

Description
A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer_form[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105289
EUVD
EUVD-2026-92393

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
feelec-yishu feelcrm-os 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the feelcrm-os CRM system affecting version 1.0.0. It occurs in the customer remark field where user input is HTML-encoded when stored but decoded when retrieved, allowing malicious scripts to execute when viewed by other users. An attacker with CRM access can inject a script via the customer_form[remark] parameter that executes when another user views the customer details.

Detection Guidance

To detect this vulnerability, inspect the CRM system's customer remark field for stored XSS payloads. Check the App/Feelcrm/Common/Model/CrmDefineFormModel.class.php file for improper use of htmlspecialchars_decode. Review network traffic for unusual requests containing script tags in customer_form[remark] parameters.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary JavaScript in the context of the CRM application. This could lead to theft of sensitive data, unauthorized actions on behalf of the user, or session hijacking. Users with CRM access could unknowingly trigger the script when viewing customer details, potentially compromising their session or data.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data through script execution or unauthorized access. For HIPAA, it may risk protected health information if CRM stores such data. Non-compliance may occur if controls to prevent XSS are lacking, leading to potential data breaches and regulatory penalties.

Mitigation Strategies

Immediately update the CRM system to remove unconditional HTML decoding in the customer remark field. Implement strict output escaping when displaying customer details. Ensure all user inputs are stored as plain text without decoding. Consider disabling the customer remark feature until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart