WU
Vendor
WuKongOpenSource
12
CVEs
0
On KEV
5
New 30D
Products
WU9.8
Wukong_HRM
WuKongOpenSource
2 CVEs0 on KEV2 new
WA8.8
Wukong AICRM
WuKongOpenSource
3 CVEs0 on KEV3 new
WU9.8
WukongCRM
WuKongOpenSource
6 CVEs0 on KEV0 new
WU6.3
Wukong_nocode
WuKongOpenSource
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110208 | WA Wukong AICRM WuKongOpenSource | 7.1 | Oct 13 | Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys |
| CVE-2026-110207 | WA Wukong AICRM WuKongOpenSource | 8.8 | Oct 13 | Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs |
| CVE-2026-108708 | WU Wukong_HRM WuKongOpenSource | 8.8 | Oct 11 | Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil |
| CVE-2026-108707 | WU Wukong_HRM WuKongOpenSource | 9.8 | Oct 11 | Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect |
| CVE-2026-108689 | WA Wukong AICRM WuKongOpenSource | 5.4 | Oct 11 | Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send |
| CVE-2026-2141 | WU WukongCRM WuKongOpenSource | 8.8 | Feb 8 | WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization |
| CVE-2025-8852 | WU WukongCRM WuKongOpenSource | 4.3 | Aug 11 | WuKongOpenSource WukongCRM API Response upload information exposure |
| CVE-2025-6106 | WU WukongCRM WuKongOpenSource | 4.3 | Jun 16 | WuKongOpenSource WukongCRM AdminRoleController.java cross-site request forgery |
| CVE-2025-5879 | WU WukongCRM WuKongOpenSource | 5.4 | Jun 9 | WuKongOpenSource WukongCRM File Upload AdminSysConfigController.java cross site scripting |
| CVE-2025-5521 | WU WukongCRM WuKongOpenSource | 8.8 | Jun 3 | WuKongOpenSource WukongCRM updataPassword cross-site request forgery |
| CVE-2024-6645 | WU Wukong_nocode WuKongOpenSource | 6.3 | Jul 10 | WuKongOpenSource Wukong_nocode AviatorScript ExpressionUtil.java deserialization |
| CVE-2024-23052 | WU Wukongcrm Wukongopensource | 9.8 | Feb 1 | An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component |