F-RevoCRM XSS Flaw CVE-2026-71368 Puts Logged-In Users at Risk

·4 views

A medium-severity cross-site scripting vulnerability, tracked as CVE-2026-71368, has been disclosed in F-RevoCRM versions 7.3.0 through 8.0.3, with a fix available in version 8.0.4. The flaw, published by JVN on August 17, 2026, allows an attacker to craft a malicious URL that, when opened by a logged-in user, executes arbitrary JavaScript within the CRM's origin. This can result in unintended CRM operations or the theft of session information using the victim's existing privileges. No authentication is required from the attacker, but the attack does depend on a valid user session and some form of user interaction, such as clicking a link sent via email or chat. Users are advised to update to version 8.0.4 immediately and to avoid opening untrusted links while logged in to the platform.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI-Refactored SQL Queries Can Silently Drop Rows Even When They Run Faster

An AI-generated SQL rewrite that swaps a LEFT JOIN for an INNER JOIN may run faster but can silently omit rows where no matching parent record exists, changing query results without any obvious error. This is a common risk in legacy databases where orphaned records — such as orders tied to non-existent customers — are present. A quick visual check of query output is insufficient to catch the data loss, since returned rows still appear valid and complete. Developers are advised to treat AI-generated query changes as unverified patches and validate them by running a differential test that compares the full result sets of the original and rewritten queries. Including edge-case fixtures — such as orphaned rows, parents with no children, duplicates, and NULL values — in the test baseline helps ensure the check catches more than just join-type conversions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A Free Model vs 30 Security Advisory Records: An Accuracy Test You Can Rerun

A single wrong severity label can push a bad dependency upgrade into production. An advisory said "moderate." The package in our tree was critical. The model guessed low. I did not trust the model after that. I wanted a repeatable accuracy test.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DeepSeek Leads on Speed and Cost as Chinese AI Models Rival Western Giants

A cloud architect conducted a six-week benchmark study comparing four major Chinese AI model families — DeepSeek, Qwen, Kimi, and GLM — across latency, cost, and reliability metrics. The evaluation was prompted by a client needing to standardize on a model for a multi-region deployment processing 12 million requests per day. DeepSeek's V4 Flash emerged as the top price-performance pick at $0.25 per million output tokens, delivering consistent p99 latency under 800ms across 100,000 test requests. Qwen offered the broadest model catalog with strong vision capabilities, Kimi led on chain-of-thought reasoning benchmarks, and GLM excelled at Chinese-language tasks. All four model families support OpenAI-compatible APIs, making migration straightforward, though their operational characteristics vary significantly under real production loads.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Hacker News users debate AI's impact on motivation and sense of purpose in tech

A post on Hacker News has sparked discussion around a growing sense of disillusionment among software developers in the age of AI. The original poster expressed feeling that traditional tech activities — such as learning new concepts, building side projects, or preparing for job interviews — have lost their meaning. They compared the experience to enabling cheat codes in a video game, where unlimited capability paradoxically drains enjoyment and purpose. The concern reflects broader anxieties in the developer community about AI automating creative and intellectual work once considered uniquely human. The thread, which garnered 17 upvotes and several comments, highlights an emerging conversation about professional identity and motivation in a rapidly shifting industry.

0 comments Read more at Hacker News