Cross-Site Scripting Vulnerability in feelec-yishu FeelCRM OS
CVE-2026-105289

5.1MEDIUM

Key Information:

Vendor: Feelec-yishu
Status: Feelcrm-os
Vendor: CVE Published:; 5 October 2026

🔔 Create Feelec-yishu Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-105289?

A vulnerability in the FeelCRM OS version 1.0.0 was identified that enables Cross-Site Scripting (XSS) through the customer_form[remark] parameter. This issue resides within the htmlspecialchars_decode function located in the App/Feelcrm/Common/Model/CrmDefineFormModel.class.php file of the Create Customer Endpoint. Attackers can exploit this vulnerability remotely, allowing them to inject malicious scripts that may result in unauthorized access or manipulation of user data. Although the project was notified about the vulnerability, no adjustments have been made to mitigate the risk, making it imperative for users to be cautious.

Affected Version(s)

feelcrm-os 1.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-105289 - Proof of Concept