Skip to content
OpenAdvisories

Product · 1Panel-dev

CordysCRM

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-63647

    CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

    CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilt…

    1Panel-dev CordysCRM