CVE-2026-105287 MEDIUM

CVE-2026-105287: feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

Vendor Feelec-Yishu

Product feelcrm-os

Weakness CWE-89 · SQLi

Published October 5, 2026

Last update October 5, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups[] causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Key dates

02Disclosure timeline

October 5, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-105287 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

CVE-2026-105287: feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

01Description

02Disclosure timeline

03References

04Related CVE