CVE-2026-112296

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296 FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

EUVD-2026-104277

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112296

The FlyCms content management system (through commit edfdf724 ) is vulnerable to a default credentials vulnerability. This flaw allows unauthenticated remote attackers to gain super administrator access by logging into the flycms account using the default password admin123 via a POST request to /...

CVE-2026-112296: Use of Default Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-110612

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on...

CVE-2026-110612 vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on...

EUVD-2026-101240

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on...

CVE-2026-110612

The vlife application (versions through 2.0.1 ) is vulnerable to an authentication bypass due to a hardcoded HS256 signing key located in the TokenUtil component. This flaw allows unauthenticated attackers to forge JWTs by injecting superUser=true and arbitrary groupIds claims, granting them supe...

CVE-2026-110612: Use of Hard-coded Cryptographic Key

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on...

Vvveb security vulnerabilities

Vvveb is a powerful and easy-to-use CMS developed by Givan’s individual developers. It is used to build websites, blogs, or e-commerce stores. Versions of Vvveb prior to 1.0.8.1 contained security vulnerabilities. These vulnerabilities stemmed from an issue with the endpoint where administrator...

CVE-2021-21918

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘namefilter’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery...

CVE-2024-57434

The Macrozheng Mall-Tiny development scaffolding (version 1.0.1 ) is vulnerable to Incorrect Access Control . The underlying cause is that the project imports users by default, which automatically grants the test user super administrator privileges. Practical consequences include unauthorized adm...

FUEL CMS Elevation of Privilege Vulnerability

FUEL CMS is a content management system based on CodeIgniter. An elevation of privilege vulnerability exists in FUEL CMS 1.4.7. The vulnerability can be exploited to gain super administrator privileges via the "id" and "fuelid" parameters...

Hefei Yilang Network Technology Co., Ltd. website building system has logical flaws and vulnerabilities

Hefei Yilang Network Technology Co., Ltd. is a company specializing in Internet technology services, development and application. Hefei a wave of network technology limited company building system there are logical flaws in the vulnerability, the attacker can use the loophole to obtain super...

Panmicro e-office Collaboration Management Platform Privilege Bypass Vulnerability

A login bypass vulnerability exists in the Panmicro e-office Collaboration Management Platform, which allows an attacker to directly log into the OA system with super administrator privileges without login credentials...

ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection

ManageEngine Password Manager Pro PMP has an authenticated blind SQL injection vulnerability in SQLAdvancedALSearchResult.cc that can be abused to escalate privileges and obtain Super Administrator access. A Super Administrator can then use his privileges to dump the whole password database in CS...