CVE-2026-125082
Deferred Deferred - Pending Action

Cross-Site Scripting in FlyCMS Content Rendering

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: VulDB

Description
A security flaw has been discovered in sunkaifei FlyCMS up to e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a. Affected by this vulnerability is the function ModelDataService.insertData of the file articles/detail.html of the component Content Rendering. Performing a manipulation of the argument content results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is named 714521a9262e7bc9ca5713c873f57e96a4845352. It is recommended to apply a patch to fix this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-125082
EUVD
EUVD-2026-120672

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sunkaifei flycms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in FlyCMS. It allows attackers to inject malicious JavaScript into the content field of articles. When users view the article, the injected script executes in their browser. The issue stems from unsanitized content submission and unescaped output rendering in the detail page templates.

Detection Guidance

Check for unsanitized content submissions in FlyCMS by inspecting user-provided content in the /ucenter/submit/{modelCode} endpoint. Look for stored XSS payloads in articles or comments. Review detail page templates for unescaped output using ${(info.content)!''} without ?html modifier. Monitor for malicious JavaScript execution in rendered pages.

Impact Analysis

Attackers can steal user data, perform unauthorized actions, or interact with admin panels due to cookie-based sessions. The attack requires only a registered user account, which can be created freely. All visitors to the affected article pages, including administrators, are at risk.

Compliance Impact

This vulnerability allows stored XSS attacks where malicious scripts can be injected into content and executed when viewed by other users, including administrators. This could lead to unauthorized data access, session hijacking, or manipulation of sensitive information, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if such data is processed by the system.

Mitigation Strategies

Apply the patch 714521a9262e7bc9ca5713c873f57e96a4845352 which adds server-side sanitization using jsoup. Enable output escaping in templates by adding ?html to ${(info.content)!''}. Implement HTML sanitization for all user submissions. Set fly_article_audit=1 to enable content review before publishing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...