Vulnerabilities

TI-2026-01791 CVE-2026-2141 · GHSA-fx8q-7873-hxrq

WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization

MEDIUM 57

A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00405 Published 2026-02-08 No fix listed CWE-266

TI-2025-37830 CVE-2025-60828 · GHSA-jw66-v638-9wc8

WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via…

MEDIUM 62

WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00361 Published 2025-10-08 No fix listed CWE-502

TI-2025-08103 CVE-2025-8852 · GHSA-vv73-j722-jwwp

WuKongOpenSource WukongCRM API Response upload information exposure

MEDIUM 57

A vulnerability was identified in WuKongOpenSource WukongCRM 11.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00399 Published 2025-08-11 No fix listed CWE-200

TI-2025-04961 CVE-2025-5521 · GHSA-8v33-w22p-qf3q

WuKongOpenSource WukongCRM updataPassword cross-site request forgery

MEDIUM 63

A vulnerability was found in WuKongOpenSource WukongCRM 9.0.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.0033 Published 2025-06-03 No fix listed CWE-352

TI-2024-15204 CVE-2024-23052 · GHSA-r2cr-gm62-vm8v

An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to…

HIGH 82

An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04912 Published 2024-02-01 No fix listed CWE-502