Vendor
Wukong AICRM versions through 20260610 contain a missing authorization vulnerability that allows authenticated users to call administrative APIs, leading to account takeover via password reset.