Guchengwuyue Yshop-Crm
4 CVEs affecting Guchengwuyue Yshop-Crm. Latest disclosed: 2026-09-16. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92463 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out… |
CVE-2026-92462 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to… |
CVE-2026-92459 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office… |
CVE-2026-92455 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office u… |