CVE-2026-112296

CriticalCVSS 9.8/10Last modified Oct 27, 2026

Description

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1392

Affected software

Vendor	Product	Versions
sunkaifei	FlyCms	<= edfdf724c3b944310f60c29aa755d03a00a75837

References

Timeline

Published: Oct 19, 2026
Last modified: Oct 27, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1122974.3A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprin CVE-2026-1122994.3A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of th CVE-2026-11239.8A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP CVE-2026-112308.8Use after free in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox vi CVE-2026-1123005.3A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file co CVE-2026-1123017.3A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the fil CVE-2026-1123026.3A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/Ar CVE-2026-1123034.3GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by suppl CVE-2026-1123047.5docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load with CVE-2026-1123058.8Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protecte CVE-2026-1123067.2NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvali CVE-2026-1123077.3sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text con