WuKongOpenSource vulnerabilities
We track 7 vulnerabilities in WuKongOpenSource products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
Latest WuKongOpenSource vulnerabilities
- 7.1 High severity
Wukong AICRM: Missing Authorization
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or
- 8.8 High severity
Wukong AICRM: Missing Authorization
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser
- 8.8 High severity
Wukong_HRM: Missing Authorization
Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read p
- 9.8 Critical severity
Wukong_HRM: Improper Authentication
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, sa
- 8.8 High severity
WukongCRM: Incorrect Authorization
A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation
- 8.8 High severity
WukongCRM: Cross-Site Request Forgery
A vulnerability was found in WuKongOpenSource WukongCRM 9.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/user/updataPassword. The manipulation leads to cross-site request forgery. The atta
- 9.8 Critical severity
wukongcrm: Deserialization of Untrusted Data
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.