PT-2025-38529 · 07Flycrm+1 · 07Flycrm+1

Zre0X1C · Published 2025-09-19 · Updated 2025-09-19 · CVE-2025-10710

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions 07FLYCMS, 07FLY-CMS, and 07FlyCRM versions up to 20250831

Description A cross-site scripting (XSS) flaw exists due to the manipulation of the Name argument in an unknown part of the /index.php file. This allows for remote execution of scripts. The exploit has been published. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions up to 20250831 are affected. As a temporary workaround, consider restricting access to the /index.php file to minimize the risk of exploitation.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-10710

Affected Products

07Flycms

07Flycrm

References · 9

• 🔥 https://github.com/1276486/CVE/issues/11 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10710 · Security Note
• https://vuldb.com/?submit.644968 · Note
• https://vuldb.com/?id.324998 · Note
• https://t.me/CVEtracker/32934 · Telegram Post
• https://vuldb.com/?ctiid.324998 · Note
• https://twitter.com/VulmonFeeds/status/1969038396975677715 · Twitter Post
• https://t.me/cveNotify/135938 · Telegram Post
• https://twitter.com/CVEnew/status/1969110899446460830 · Twitter Post