Cross-Site Scripting Vulnerability in sunkaifei FlyCMS Content Rendering
CVE-2026-125082

5.1MEDIUM

Key Information:

Vendor

Sunkaifei

Status
Flycms
Vendor
CVE Published:
10 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-125082?

A security flaw exists in sunkaifei FlyCMS affecting the content rendering functionality, specifically within the ModelDataService.insertData method of articles/detail.html. This vulnerability allows remote attackers to perform cross-site scripting attacks by manipulating the content argument. The flaw has been publicly disclosed and poses a significant risk since it enables unauthorized code execution in the browser of users. It is essential to apply the designated patch to mitigate potential exploits, as continuous delivery with rolling releases means version-specific updates may not be readily available. The vulnerability can be effectively addressed by applying the provided patch 714521a9262e7bc9ca5713c873f57e96a4845352.

Affected Version(s)

FlyCMS e71738e0cfb7ffd48c2ce74242a2dbb43f84f25a

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-125082 - Proof of Concept

References

https://vuldb.com/vuln/433192
vdb-entrytechnical-description
https://vuldb.com/vuln/433192/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-125082
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

s1mple_xy (VulDB User)
.