CVE-2026-112296 — FlyCms through commit edfdf724 Default Super Administrator Credentials
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms accoun…
Published: 2026-10-19 · CVSS: 9.3 · CVSS 4.0
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7