CVE-2026-105290 | feelec-yishu feelcrm-os 1.0.0 getCurlData Endpoint GoogleController.class.php url server-side request forgery

October 5, 2026 Yanac

A vulnerability categorized as critical has been discovered in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery.

This vulnerability is registered as CVE-2026-105290. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More