Login Request a demo
Medium severity · published Dec 26, 2025
CVE-2025-15093
sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown function of the file src/main/java/com/flycms/web/system/IndexAdminController.java of the component Admin Login. Performing a manipulation of the argument redirectUrl results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
FlyCMS · sunkaifei
abbaa5a8daefb146ad4d61027035026b052cb414 · source: vendor, NVD
Affected product
FL
FlyCMS
sunkaifei
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15093
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15093
github.com
https://github.com/sunkaifei/FlyCms/
Exploit
https://github.com/sunkaifei/FlyCms/issues/15
Permissions Required
https://vuldb.com/?ctiid.338422
Third Party Advisory
https://vuldb.com/?id.338422
Third Party Advisory
https://vuldb.com/?submit.708996
More from FlyCMS
9.8
CVE-2026-112296
FlyCms through commit edfdf724 Default Super Administrator Credentials
8.8
CVE-2024-22939
Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_edit component
6.1
CVE-2025-15094
sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting
5.4
CVE-2026-112295
FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update
4.3
CVE-2026-112294
FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint