CVE-2025-15093

A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown function of the file src/main/java/com/flycms/web/system/IndexAdminController.java of the component Admin Login. Performing a manipulation of the argument redirectUrl results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-79
• CWE-94

• https://github.com/sunkaifei/FlyCms/
• https://github.com/sunkaifei/FlyCms/issues/15Exploit, Issue Tracking, Vendor Advisory
• https://vuldb.com/?ctiid.338422Permissions Required, VDB Entry
• https://vuldb.com/?id.338422Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.708996Third Party Advisory, VDB Entry
• https://github.com/sunkaifei/FlyCms/issues/15Exploit, Issue Tracking, Vendor Advisory

Published

Dec 26, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15088A vulnerability was detected in ketr JEPaaS up to 7.2.8. Aff…6.3
• CVE-2025-15089A vulnerability has been found in UTT 进取 512W up to 1.7.7-17…9.8
• CVE-2025-1509The The Show Me The Cookies plugin for WordPress is vulnerab…9.8
• CVE-2025-15090A vulnerability was found in UTT 进取 512W up to 1.7.7-171114.…9.8
• CVE-2025-15091A vulnerability was determined in UTT 进取 512W up to 1.7.7-17…9.8
• CVE-2025-15092A vulnerability was identified in UTT 进取 512W up to 1.7.7-17…9.8
• CVE-2025-15094A weakness has been identified in sunkaifei FlyCMS up to abb…6.1
• CVE-2025-15095A security vulnerability has been detected in postmanlabs ht…3.5
• CVE-2025-15096The 'Videospirecore Theme Plugin' plugin for WordPress is vu…8.8
• CVE-2025-15097A vulnerability was found in Alteryx Server. Affected by thi…7.3
• CVE-2025-15098A vulnerability was determined in YunaiV yudao-cloud up to 2…6.3
• CVE-2025-15099A vulnerability was identified in simstudioai sim up to 0.5.…9.8