Is CVE-2026-52745 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52745 being exploited in the wild.

How severe is CVE-2026-52745?

Medium severity, with a CVSS score of 5.3, published 18 September 2026.

Which products and versions are affected?

1Panel-dev CordysCRM before 1.7.0.

Is there a fix for CVE-2026-52745?

A patch was published on 2026-05-26: Fix released in version 1.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52745 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-52745?

Check whether you run 1Panel-dev CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52745: CordysCRM SQL injection in account-pool sorting endpoint

CVE-2026-52745 · Severity: medium · CVSS 5.3 · Published 2026-09-18

CordysCRM is an open-source AI-powered customer relationship management system used for managing business customer data. A flaw in the account pool sorting feature allows authenticated users with specific permissions to inject malicious SQL code through the sort field, potentially exposing sensitive database information or degrading system performance through time-based delays.

Technologies: 1Panel-dev CordysCRM. Vendors: 1Panel-dev.

Quick answers

Is CVE-2026-52745 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52745 being exploited in the wild.
How severe is CVE-2026-52745?: Medium severity, with a CVSS score of 5.3, published 18 September 2026.
Which products and versions are affected?: 1Panel-dev CordysCRM before 1.7.0.
Is there a fix for CVE-2026-52745?: A patch was published on 2026-05-26: Fix released in version 1.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52745 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-52745?: Check whether you run 1Panel-dev CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The POST /account-pool/page endpoint in CordysCRM prior to 1.7.0 fails to properly validate the sort.name parameter before incorporating it into a dynamic SQL ORDER BY clause, enabling time-based blind SQL injection. An authenticated attacker with MODULE_SETTING:UPDATE permission can exploit this to infer database metadata, extract sensitive values, and introduce performance degradation. The vulnerability is remediated in version 1.7.0 through enhanced SQL injection protection.

Affected products

1Panel-dev CordysCRM before 1.7.0

Timeline

2026-09-18: disclosed
2026-05-26: patched: Fix released in version 1.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.