CVE-2026-10771
crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery
Vexday Risk Score
33Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 6.9EPSS 0.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
03 Jun 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
crmeb · crmeb_javapublic PoCs found — 1
cve_referencegithub.com/crmeb/crmeb_java/issues/35unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.