critical9.8
CVE-2025-70981
CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter.
Impact
CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fit2cloud | Cordys Crm | Version 1.4.1 |