CVE-2025-25379

The 07FLYCMS content management system (version 1.3.9 ) is vulnerable to a Cross-Site Request Forgery (CSRF) issue. A remote attacker can exploit the id parameter within the del.html component to achieve arbitrary code execution . To mitigate this risk, it is recommended to restrict access to the...

CVE-2024-51157

The 07FLYCMS content management system, version V1.3.9 , contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw is located in the component http://erp.07fly.net:80/oa/OaSchedule/add.html . Exploitation of this vulnerability could allow an attacker to perform unauthorized actions on...

CVE-2024-51156

The open-source content management system 07FLYCMS version V1.3.9 is vulnerable to a Cross-Site Request Forgery (CSRF) issue. This vulnerability exists within the component located at erp.07fly.net:80/admin/SysNotifyUser/del.html?id=93 , which could allow an attacker to perform unauthorized reque...

CVE-2024-57159

The open-source content management system 07FLYCMS version V1.3.9 is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw is specifically located in the /erp.07fly.net:80/oa/OaWorkReport/add.html API endpoint. This vulnerability could allow unauthorized actions to be performed on behalf o...

CVE-2024-57611

The content management system 07FLYCMS version V1.3.9 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The vulnerability is located in the admin/doAdminAction.php?act=editShop&shopId endpoint, which may allow an attacker to perform unauthorized actions. To mitigate this risk, it is re...

CVE-2024-9903

CVE-2024-9903 affects 07FLYCMS, 07FLY-CMS and 07FlyCRM up to version 1.2.0. The vulnerability is in the fileUpload function at /admin/File/fileUpload, where manipulating the file argument leads to unrestricted file upload. It can be triggered remotely and the exploit has been disclosed publicly. ...

CVE-2024-9856

CVE-2024-9856 affects 07FLYCMS/07FLY-CMS/07FlyCRM v1.3.8. A vulnerability in the System Settings Page, via manipulation of the Login Interface Copyright, enables cross-site scripting. The issue can be exploited remotely and the exploit has been disclosed publicly. Affected products are also refer...

CVE-2024-9855

CVE-2024-9855 affects 07FLYCMS/07FLY-CMS/07FlyCRM 1.3.8. The vulnerability lies in Module Plug-In Handler’s uploadFile (path /admin/SysModule/upload/ajaxmodel/upload/uploadfilepath/sysmodule_1), where manipulating the file argument enables unrestricted uploads. Exploitation is remote and publicly...

CVE-2024-9904

CVE-2024-9904 affects 07FLYCMS, 07FLY-CMS and 07FlyCRM up to version 1.2.0. The flaw is in the function pictureUpload under /admin/File/pictureUpload, where manipulating the file argument enables unrestricted remote upload. Exploitation has been publicly disclosed; multiple sources corroborate th...

CVE-2025-7078

CVE-2025-7078 affects 07FLYCMS, 07FLY-CMS and 07FlyCRM up to version 1.3.9. The issue is a cross-site request forgery (CSRF) in unknown code, exploitable remotely and with a publicly disclosed exploit. Several connected sources (Red Hat, NVD, PT Security) corroborate the CSRF nature and affected ...