Cross Site Scripting Vulnerability in sunkaifei FlyCMS User Login Function
CVE-2025-15094

5.3MEDIUM

Key Information:

Vendor

Sunkaifei

Status
Flycms
Vendor
CVE Published:
26 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-15094?

A vulnerability has been found in the user login function of sunkaifei FlyCMS, which can be exploited through manipulation of the redirectUrl parameter. This weakness allows attackers to execute cross site scripting (XSS) attacks remotely, compromising the security of users accessing the application. The exploited function is located in the UserController.java file. As this product lacks versioning, identifying the scope of affected and unaffected releases remains challenging. Despite being notified of the issue, the project maintainers have not provided a response.

Affected Version(s)

FlyCMS abbaa5a8daefb146ad4d61027035026b052cb414

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-15094 - Proof of Concept

References

https://vuldb.com/?id.338423
vdb-entrytechnical-description
https://vuldb.com/?ctiid.338423
signaturepermissions-required
https://vuldb.com/?submit.708997
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

ZAST.AI (VulDB User)
JSON
.
CVE-2025-15094 : Cross Site Scripting Vulnerability in sunkaifei FlyCMS User Login Function