Live › vulnerability › CVE-2026-112025
Go to dashboardlight0011 CMS never checks the CAPTCHA on the server. The CAPTCHA is only checked in browser JavaScript, so a script can register accounts and guess passwords without solving it. The Home/User register and login endpoints are affected, and the admin login has no server-side CAPTCHA or rate limiting either. The issue is public with curl reproduction steps. The project has not responded and no fix exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running light0011/cms (a PHP CMS) at commit c774dce or f72cf46, or any later checkout, with the site reachable from the internet. The flaw lets anonymous attackers mass-create accounts, check which usernames exist and guess passwords without a CAPTCHA, including on the admin login. It does not give direct code execution or data access by itself.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| light0011/cms | github | c774dce31c6df0055568a8d5c53d964d99be199d, f72cf46f601efb2a0618c3814cc2f61380b38930 (rolling release, no versions) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112025")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.