CVE-2026-108705Proof of concept (PoC) published · CISA
CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
CVSS score
5.3
EPSS probability
%0.2
Risk score
0.0
Published
5 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
10.0
CVE-2026-77521
MaxKB: Prompt-injectable agent can lead to command execution
1
Patch status unknownEPSS %1
10.0
CVE-2026-65956
KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF
1
Patch status unknownEPSS %1
9.3
CVE-2026-63647
CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
1
Patch status unknownEPSS %0
6.9
CVE-2026-63646
CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users
1
Patch status unknownEPSS %1
9.1
CVE-2026-79916
MaxKB AWS Bedrock model credential injection leads to remote code execution
1
Patch status unknownEPSS %0
6.8
CVE-2026-76900
CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
1
Patch status unknownEPSS %1
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-108705"