CVE-2025-15094
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability was discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414 involving cross-site scripting in the userLogin function in the file src/main/java/com/flycms/web/front/UserController.java. Manipulation of the redirectUrl argument allows remote attack execution. The exploit is publicly available and may be used.
Risk Assessment
An attacker can remotely inject a malicious script that executes in the user's browser, potentially leading to session theft or other attacks. The public exploit increases the risk.
Recommendation
Sanitize input data and use appropriate security headers, e.g., Content-Security-Policy. Restrict access to the vulnerable file.
Other vulnerabilities in FlyCMS
See all- CVE-2026-112296Critical
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
- CVE-2026-112295Medium
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
- CVE-2026-112294Medium
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
Original NVD description (English source)
A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Login. Executing a manipulation of the argument redirectUrl can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS