Live › vulnerability › CVE-2026-112296
Go to dashboardFlyCms, a PHP content management system, ships with a default super administrator account named flycms with password admin123 through commit edfdf724. An unauthenticated remote attacker can log in at POST /api/auth/login by solving only the image captcha and gets full control of site content, users and configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Try logging in to the admin login with username flycms and password admin123 on any FlyCms install.
Change the flycms account password or disable the account, then move to a FlyCms release after commit edfdf724 that removes the default credential.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-112296")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.