PT-2026-21489 · 07Flycms+1 · 07Flycms+1

Din4 · Published 2026-02-23 · Updated 2026-02-23 · CVE-2026-2965

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions 07FLYCMS versions up to 1.2.9 07FLY-CMS versions up to 1.2.9 07FlyCRM versions up to 1.2.9

Description A security flaw exists in 07FLYCMS, 07FLY-CMS, and 07FlyCRM. The issue is related to cross site scripting, triggered by manipulating the Title argument within an unknown function of the /admin/SysModule/edit.html file in the System Extension Module. The attack can be initiated remotely, and the exploit has been publicly released. The vendor was contacted but did not respond.

Recommendations Versions prior to 1.2.9 should be updated. As a temporary workaround, consider restricting access to the /admin/SysModule/edit.html file. Avoid using the Title parameter in the affected file until the issue is resolved.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-2965

Affected Products

07Flycms

07Flycrm

References · 8

• 🔥 https://notion.so/07FlyCRM-Stored-Cross-Site-Scripting-XSS-in-SysModule-module-303ea92a3c4180d3a9a8e9f6c3d2915a?v=2ffea92a3c418057a8b7000c66564aa1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2965 · Security Note
• https://twitter.com/CVEnew/status/2025809030619476419 · Twitter Post
• https://vuldb.com/?ctiid.347332 · Note
• https://vuldb.com/?submit.755225 · Note
• https://t.me/cveNotify/152804 · Telegram Post
• https://vuldb.com/?id.347332 · Note
• https://t.me/CVEtracker/45467 · Telegram Post