feelcrm-os EUVD-2026-92392

Reflected XSS reachable by sending a victim a crafted URL whose 'redirect_url' argument (handled in App/ThinkPHP/Common/functions.php via IndexController::index in the Crm Endpoint) contains script payload; no authentication is required of the attacker (PR:N), but exploitation REQUIRES victim interaction (UI:P) - a user must open the attacker-supplied link - which substantially limits mass exploitation. Impact is confined to client-side script execution in the victim's browser (integrity-only, VI:L); no server-side confidentiality or availability compromise. No patch is available since the vendor has not responded.

This is a low-priority issue despite being network-reachable and unauthenticated. The CVSS 4.0 base score is only 2.1, consistent with a reflected cross-site scripting flaw: AV:N (remote) and PR:N (no privileges) raise reachability, but UI:P (passive user interaction required) plus impact limited to VI:L (low integrity, no confidentiality or availability loss) cap the real severity. The provided vector carries E:P, indicating proof-of-concept exploit maturity - so publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score in the supplied data, so there is no evidence of active or widespread exploitation. The SSVC/exploitation signals and automatability fields were not provided. Netting these out: the one elevating signal (public POC) is offset by low technical impact, mandatory victim interaction, and the obscurity of the affected product. EPSS is absent rather than low, so no probabilistic exploitation estimate can be asserted. This reads as a genuine-but-minor web bug, not an emergency; patch on a normal maintenance cycle.

An attacker crafts a malicious link to the CRM endpoint with a tainted 'redirect_url' parameter containing JavaScript, then lures an authenticated operator or user into clicking it (UI required). When the IndexController::index flow reflects the unsanitized value, the script executes in the victim's browser session. A public proof-of-concept for this reflected XSS has been disclosed.