CVE-2026-112296
Critical · 9.8CVSS
9.8
EPSS
0.4%
Published
Oct 19, 2026
CISA due date
—
The record
FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-22109 The shipped WebUI template database retains the factory default passwords for all five… CWE-1392
- CVE-2026-22105 Delta UFC500 charging stations derive the default credentials of the Service account from… CWE-1392
- CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default… CWE-1392
- CVE-2026-55457 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-1392
- CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials… CWE-1392
- CVE-2026-86464 In the current development version of Eclipse aeriOS, for which no official release has… CWE-1392
- CVE-2026-65313 A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering… CWE-1392
- CVE-2026-68503 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. CWE-1392