sunkaifei has 5 CVEs on record between 2025 and 2026. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 4.3 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Weakness classes
Products
- FlyCms 5
Worst active — by depth score
CVE-2026-112296Critical· 9.8FlyCms through commit edfdf724 Default Super Administrator Credentials54CVE-2026-112295Medium· 5.4FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update30CVE-2026-112294Medium· 4.3FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint24CVE-2025-15094Medium· 4.3A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb41424CVE-2025-15093Medium· 4.3A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb41424
sunkaifei vulnerabilities
CVEs affecting sunkaifei, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-112294Medium· 4.3FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered u…
CVE-2026-112295Medium· 5.4FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their re…
CVE-2026-112296Critical· 9.8FlyCms through commit edfdf724 Default Super Administrator Credentials
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST …
CVE-2025-15093Medium· 4.3A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414
A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown function of the file src/main/java/com/flycms/web/system/IndexAdminController.java of the componen…
CVE-2025-15094Medium· 4.3A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414
A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Lo…