PT-2026-21489 · 07Flycms+1 · 07Flycms+1

Din4 · Publicado 2026-02-23 · Atualizado 2026-02-23 · CVE-2026-2965

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions 07FLYCMS versions up to 1.2.9 07FLY-CMS versions up to 1.2.9 07FlyCRM versions up to 1.2.9

Description A security flaw exists in 07FLYCMS, 07FLY-CMS, and 07FlyCRM. The issue is related to cross site scripting, triggered by manipulating the Title argument within an unknown function of the /admin/SysModule/edit.html file in the System Extension Module. The attack can be initiated remotely, and the exploit has been publicly released. The vendor was contacted but did not respond.

Recommendations Versions prior to 1.2.9 should be updated. As a temporary workaround, consider restricting access to the /admin/SysModule/edit.html file. Avoid using the Title parameter in the affected file until the issue is resolved.

Exploit

Correção

Code Injection

XSS

Enumeração de Fraquezas

CWE-94

CWE-79

Identificadores relacionados

CVE-2026-2965

Produtos afetados

07Flycms

07Flycrm

Referências · 8

• 🔥 https://notion.so/07FlyCRM-Stored-Cross-Site-Scripting-XSS-in-SysModule-module-303ea92a3c4180d3a9a8e9f6c3d2915a?v=2ffea92a3c418057a8b7000c66564aa1 · Exploit
• https://twitter.com/CVEnew/status/2025809030619476419 · Publicação no Twitter
• https://vuldb.com/?ctiid.347332 · Nota
• https://vuldb.com/?submit.755225 · Nota
• https://t.me/cveNotify/152804 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-2965 · Nota de Segurança
• https://vuldb.com/?id.347332 · Nota
• https://t.me/CVEtracker/45467 · Publicação no Telegram