Sunkaifei
Monthly
Stored cross-site scripting in FlyCMS allows users who can submit or author rich-text article content to inject HTML or JavaScript through the content argument processed by ModelDataService.insertData and rendered from articles/detail.html. The malicious content is stored without server-side sanitization and can execute when a reviewer or administrator opens it in the backend, within the same session domain. The vendor fixed this in commit 714521a9262e7bc9ca5713c873f57e96a4845352; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry confirms active exploitation.
Reflected cross-site scripting (XSS) in sunkaifei FlyCMS userLogin function allows unauthenticated remote attackers to inject malicious scripts via the redirectUrl parameter, requiring user interaction to trigger. The vulnerability is publicly available for exploitation with a low CVSS score of 2.1 reflecting limited integrity impact, but active public PoC code exists and the affected project has not responded to disclosure.
Cross-site scripting (XSS) in sunkaifei FlyCMS Admin Login component allows remote attackers to inject malicious scripts via the redirectUrl parameter in IndexAdminController.java. The vulnerability requires user interaction (UI:P) and results in limited integrity impact (VI:L), with a very low CVSS score of 2.1 despite public exploit availability. Active exploitation risk is minimal given the low EPSS score (0.02%, 6th percentile) and requirement for social engineering the admin user.
Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_edit component. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in FlyCMS allows users who can submit or author rich-text article content to inject HTML or JavaScript through the content argument processed by ModelDataService.insertData and rendered from articles/detail.html. The malicious content is stored without server-side sanitization and can execute when a reviewer or administrator opens it in the backend, within the same session domain. The vendor fixed this in commit 714521a9262e7bc9ca5713c873f57e96a4845352; a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry confirms active exploitation.
Reflected cross-site scripting (XSS) in sunkaifei FlyCMS userLogin function allows unauthenticated remote attackers to inject malicious scripts via the redirectUrl parameter, requiring user interaction to trigger. The vulnerability is publicly available for exploitation with a low CVSS score of 2.1 reflecting limited integrity impact, but active public PoC code exists and the affected project has not responded to disclosure.
Cross-site scripting (XSS) in sunkaifei FlyCMS Admin Login component allows remote attackers to inject malicious scripts via the redirectUrl parameter in IndexAdminController.java. The vulnerability requires user interaction (UI:P) and results in limited integrity impact (VI:L), with a very low CVSS score of 2.1 despite public exploit availability. Active exploitation risk is minimal given the low EPSS score (0.02%, 6th percentile) and requirement for social engineering the admin user.
Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_edit component. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.