Sunkaifei
Vulnerability activity for Sunkaifei: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 9.8CriticalOct 19, 2026Sunkaifei FlyCmsCVE-2026-112296FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
- 5.4MediumOct 19, 2026Sunkaifei FlyCmsCVE-2026-112295FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
- 4.3MediumOct 19, 2026Sunkaifei FlyCms Auth bypass / access controlCVE-2026-112294FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.
Top products
- FlyCms3 CVEs in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.