Description
CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter.
Critical · 9.8
CVE-2025-70981
EUVD-2025-207244GHSA-qr83-6r38-ch55
CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter.
Published Feb 12, 2026 · Updated Feb 12, 2026 · Assigned by mitre