Is there a public PoC exploit available for CVE-2025-15094?

Yes, a public proof-of-concept exploit is available for CVE-2025-15094. Prioritise patching immediately. EPSS: 0.0%.

sunkaifei FlyCMS CVE-2025-15094

Q: What is the CVSS score of CVE-2025-15094?

CVE-2025-15094 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-12-26 cna@vuldb.com

XSS Java Flycms Sunkaifei

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 03:01 vuln.today

DescriptionCVE.org

A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Login. Executing a manipulation of the argument redirectUrl can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Reflected cross-site scripting (XSS) in sunkaifei FlyCMS userLogin function allows unauthenticated remote attackers to inject malicious scripts via the redirectUrl parameter, requiring user interaction to trigger. The vulnerability is publicly available for exploitation with a low CVSS score of 2.1 reflecting limited integrity impact, but active public PoC code exists and the affected project has not responded to disclosure.

Technical ContextAI

FlyCMS is a Java-based content management system where the UserController class handles user authentication. The vulnerability stems from improper input validation in the userLogin method of src/main/java/com/flycms/web/front/UserController.java when processing the redirectUrl parameter. The redirectUrl value is likely passed directly to a response header or HTML context without sanitization, allowing attackers to break out of the intended context and inject arbitrary JavaScript. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as failure to encode user-supplied data before rendering in a web response. The CPE cpe:2.3:a:sunkaifei:flycms:*:*:*:*:*:*:*:* indicates all versions of FlyCMS are affected since the project does not maintain semantic versioning, and the git commit hash abbaa5a8daefb146ad4d61027035026b052cb414 represents the latest known vulnerable state.

RemediationAI

No vendor-released patch identified at time of analysis. The FlyCMS project was informed early via GitHub issue #16 (https://github.com/sunkaifei/FlyCms/issues/16) but has not responded or released a fix. Immediate mitigation requires implementing output encoding for the redirectUrl parameter in UserController.java userLogin method using a Java encoding library such as OWASP Encoder or Apache Commons Text to escape HTML special characters before rendering in HTTP responses or HTML attributes. Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or event handler patterns in the redirectUrl parameter. As a compensating control, restrict the redirectUrl parameter to a whitelist of known safe domains to prevent open redirect combined with XSS. Enforce Content Security Policy (CSP) headers with script-src 'self' to limit inline script execution, which will degrade but not eliminate reflected XSS impact. Monitor for exploitation via access logs containing suspicious characters (%, script, onerror, onload) in the redirectUrl parameter. Consider forking the project or migrating to an actively maintained CMS if security updates are critical for your deployment.