CVE-2026-16222

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16222", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-18T12:11:08.681Z", "datePublished": "2026-07-19T06:45:09.639Z", "dateUpdated": "2026-07-20T10:26:14.132Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-19T06:45:09.639Z"}, "title": "1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "Server-Side Request Forgery"}]}], "affected": [{"vendor": "1Panel-dev", "product": "CordysCRM", "versions": [{"version": "1.4.0", "status": "affected"}, {"version": "1.4.1", "status": "affected"}], "cpes": ["cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"], "modules": ["Third Party Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-07-18T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-18T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-18T14:16:18.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "liushaozhe (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/380044", "name": "VDB-380044 | 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/380044/cti", "name": "VDB-380044 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16222", "name": "CVE-2026-16222 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/858043", "name": "Submit #858043 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/858044", "name": "Submit #858044 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/1Panel-dev/CordysCRM/issues/2685", "tags": ["issue-tracking"]}, {"url": "https://github.com/1Panel-dev/CordysCRM/issues/2686", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/1Panel-dev/CordysCRM/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T10:26:00.551051Z", "id": "CVE-2026-16222", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T10:26:14.132Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16222", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T10:26:00.551051Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T10:26:09.235Z"}}], "cna": {"title": "1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery", "credits": [{"lang": "en", "type": "reporter", "value": "liushaozhe (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"], "vendor": "1Panel-dev", "modules": ["Third Party Endpoint"], "product": "CordysCRM", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.4.1"}]}], "timeline": [{"lang": "en", "time": "2026-07-18T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-18T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-18T14:16:18.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/380044", "name": "VDB-380044 | 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/380044/cti", "name": "VDB-380044 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-16222", "name": "CVE-2026-16222 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/858043", "name": "Submit #858043 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/858044", "name": "Submit #858044 | 1Panel-dev CordysCRM 1.4.1 Server-Side Request Forgery (Duplicate)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/1Panel-dev/CordysCRM/issues/2685", "tags": ["issue-tracking"]}, {"url": "https://github.com/1Panel-dev/CordysCRM/issues/2686", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/1Panel-dev/CordysCRM/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-19T06:45:09.639Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16222", "state": "PUBLISHED", "dateUpdated": "2026-07-20T10:26:14.132Z", "dateReserved": "2026-07-18T12:11:08.681Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-19T06:45:09.639Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:1panel-dev:cordyscrm:*:*:*:*:*:*:*:*"], "modules": ["Third Party Endpoint"], "product": "CordysCRM", "vendor": "1Panel-dev", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.4.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en 1Panel-dev CordysCRM hasta 1.4.1. Este problema afecta alg\u00fan procesamiento desconocido del archivo backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java del componente Punto Final de Terceros. Realizar una manipulaci\u00f3n del argumento mkAddress resulta en falsificaci\u00f3n de petici\u00f3n del lado del servidor. El ataque puede ser iniciado remotamente. El exploit ha sido hecho p\u00fablico y podr\u00eda ser usado. El proyecto cerr\u00f3 el informe del problema, declarando que esta no es la forma oficial de reportar una vulnerabilidad de seguridad."}], "id": "CVE-2026-16222", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16222", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T10:26:00.551051Z", "version": "2.0.3"}}]}, "published": "2026-07-19T08:16:42.620", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/1Panel-dev/CordysCRM/"}, {"source": "cna@vuldb.com", "url": "https://github.com/1Panel-dev/CordysCRM/issues/2685"}, {"source": "cna@vuldb.com", "url": "https://github.com/1Panel-dev/CordysCRM/issues/2686"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-16222"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/858043"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/858044"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/380044"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/380044/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.4.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CordysCRM", "source": "cna", "vendor": "1Panel-dev"}, "product": "cordyscrm", "vendor": "1panel-dev"}], "created": "2026-07-21T20:15:02.485495+00:00", "updated": "2026-07-30T22:45:04.014962+00:00", "vendors": ["1panel-dev", "1panel-dev$PRODUCT$cordyscrm"]}