{"id":"CVE-2026-112030","kind":"vulnerability","aliases":["CVE-2026-112030"],"related":[],"title":"Diem: default password in data loader lets remote attackers in","description":"A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is suggested to update the configuration settings. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Diem, a PHP content management project, ships a data loader file (dmCorePlugin/lib/data/dmDataLoad.php) that uses a default password. A remote attacker who knows or guesses that default can perform actions the password protects.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["diem","package","php","self-hosted"],"not_affected_if":["default-password-changed"],"how_to_check":"- Check the installed Diem version against `5.1.3`; versions up to and including `5.1.3` are listed as affected.\n- Look for the default password in `dmCorePlugin/lib/data/dmDataLoad.php` and confirm whether it has been changed.","fix":"- The sources do not name a fixed version: unknown.\n- Change the default password in the configuration to a unique value, as the description suggests updating the configuration settings.","status":"open","published_at":"2026-10-19T00:16:30+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:25+00:00","updated_at":"2026-10-25T03:57:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:57:25Z","model":"claude-haiku-5-5","output":{"fix":"- The sources do not name a fixed version: unknown.\n- Change the default password in the configuration to a unique value, as the description suggests updating the configuration settings.","reach":"internet","title":"Diem: default password in data loader lets remote attackers in","impact":"medium","summary":"Diem, a PHP content management project, ships a data loader file (dmCorePlugin/lib/data/dmDataLoad.php) that uses a default password. A remote attacker who knows or guesses that default can perform actions the password protects.","category":"package","nicknames":[],"who_cares":["php","diem","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker uses default password to access protected functions","analyst_note":"Confirm which function the default password protects and whether a fixed version exists; check the NVD entry and the project's issue tracker.","how_to_check":"- Check the installed Diem version against `5.1.3`; versions up to and including `5.1.3` are listed as affected.\n- Look for the default password in `dmCorePlugin/lib/data/dmDataLoad.php` and confirm whether it has been changed.","needs_analyst":true,"not_affected_if":["default-password-changed"],"who_is_affected":"Installations of Diem up to and including 5.1.3 that still use the default password are exposed to remote access. Sites that changed the default credential in configuration are likely not affected. The sources do not say which deployment roles or features are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000602,"input_tokens":3346,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112030':12A,15A '-2026':11A,14A '5.1.3':65C 'action':50B 'affect':68C 'attack':9A,41B,85C 'carri':90C 'code':70C 'configur':109C 'content':25B 'could':100C 'cve':10A,13A 'data':5A,30B 'default':2A,37B,47B,82C 'diem':1A,16B,22B,60C,62C 'diem-project':59C 'dmcoreplugin/lib/data/dmdataload.php':33B,74C 'earli':118C 'exploit':94C 'file':32B,73C 'found':57C 'guess':45B 'host':21B 'inform':114C 'issu':121C 'know':43B 'let':7A 'loader':6A,31B 'made':97C 'manag':26B 'manipul':77C 'packag':17B 'password':3A,38B,52B,83C 'perform':49B,75C 'php':18B,24B 'possibl':87C 'problem':117C 'project':27B,61C,112C 'protect':53B 'public':98C 'remot':8A,40B,92C 'report':122C 'respond':126C 'result':78C 'self':20B 'self-host':19B 'set':110C 'ship':28B 'suggest':105C 'unknown':69C 'updat':107C 'use':35B,80C,102C 'vulner':55C,67C 'yet':127C","nicknames":[],"mitigations":[],"who_affected":"Installations of Diem up to and including 5.1.3 that still use the default password are exposed to remote access. Sites that changed the default credential in configuration are likely not affected. The sources do not say which deployment roles or features are required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T00:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112030","severity":null,"published_at":"2026-10-19T00:16:30+00:00","modified_at":"2026-10-22T03:16:33+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}