CVE-2025-70981 | CordysCRM 1.4.1 Employee List Query Interface /user/list departmentIds sql injection

A vulnerability was found in CordysCRM 1.4.1. It has been declared as critical. The impacted element is an unknown function of the file /user/list of the component Employee List Query Interface. The manipulation of the argument departmentIds results in sql injection.

This vulnerability is reported as CVE-2025-70981. The attack can be launched remotely. No exploit exists.