Live › vulnerability › CVE-2026-112030
Go to dashboardDiem, a PHP content management project, ships a data loader file (dmCorePlugin/lib/data/dmDataLoad.php) that uses a default password. A remote attacker who knows or guesses that default can perform actions the password protects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations of Diem up to and including 5.1.3 that still use the default password are exposed to remote access. Sites that changed the default credential in configuration are likely not affected. The sources do not say which deployment roles or features are required.
No product ranges from the sources yet.
5.1.3; versions up to and including 5.1.3 are listed as affected.dmCorePlugin/lib/data/dmDataLoad.php and confirm whether it has been changed.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is suggested to update the configuration settings. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112030")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.