CVE-2026-46237.3HighCWE-918

CVE-2026-4623: DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery

DefaultFuction · Jeson-Customer-Relationship-Management-System

Vendor fix available · Affected: DefaultFuction Jeson-Customer-Relationship-Management-System · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.3%probability of exploitation in the next 30 days

27th percentile

050100

Higher than 27% of scored CVEs

7.3HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The identifier of the patch is f76e7123fe093b8675f88ec8f71725b0dd186310/98bd4eb07fa19d4f2c5228de6395580013c97476. It is suggested to install a patch to address this issue.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

DefaultFuction · Jeson-Customer-Relationship-Management-SystemVersions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Server-Side Request Forgery
Vendor: DefaultFuction
Published: March 2026
Band: Unlikely (under 1%), March 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-4623 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.