# CVE-2026-92418: ChangeWeDer CRM cross-site scripting in customer save endpoint

Source: https://junglewise.ai/threats/cve-2026-92418-changeweder-crm-cross-site-scripting-in-customer-save-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92418 · Severity: low · CVSS 3.5 · Published 2026-09-16

ChangeWeDer CRM is a customer relationship management system built with Spring Boot. A stored cross-site scripting (XSS) vulnerability in the customer save endpoint allows attackers to inject malicious JavaScript code through the customer name field, which is then stored and executed in the browsers of other users viewing customer records. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of affected users.

## Quick answers

**Is CVE-2026-92418 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92418 being exploited in the wild.

**How severe is CVE-2026-92418?** Low severity, with a CVSS score of 3.5, published 16 September 2026.

**Which products and versions are affected?** ChangeWeDer CRM up to c07bd4c97141521af6475034bc58523beed51bbd.

**Is there a fix for CVE-2026-92418?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92418 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92418?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored XSS flaw in the Save Endpoint component, specifically in the file src/main/resources/public/js/customerServe/customer.serve.js. The root cause is inadequate input validation and output encoding on the customerName parameter submitted to /customer_serve/save and /sale_chance/save endpoints. An authenticated attacker can submit a POST request with XSS payload in the customerName field; the unsanitized input is stored in the database and then rendered without proper HTML escaping when the customer data is displayed to other users. No authentication bypass is required—the attacker must have legitimate access to the application. The vulnerability is publicly disclosed and exploitable, though not reported as actively exploited in the wild. The project maintainer has not yet responded to the issue report.

## Affected products

- ChangeWeDer CRM up to c07bd4c97141521af6475034bc58523beed51bbd

## Timeline

- 2026-08-20: disclosed: Vulnerability reported via GitHub issue
- 2026-09-16: advisory: CVE-2026-92418 published

## References

- [https://github.com/ChangeWeDer/crm/](https://github.com/ChangeWeDer/crm/)
- [https://github.com/ChangeWeDer/crm/issues/4](https://github.com/ChangeWeDer/crm/issues/4)