CVE-2025-15094

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-15094
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15094.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-15094
Published
2025-12-26T01:32:06Z
Modified
2026-10-21T02:52:10Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting
Details

A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Login. Executing a manipulation of the argument redirectUrl can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15094.json"
}
References

Affected packages

Git / github.com/sunkaifei/flycms

Affected ranges

Type
GIT
Repo
https://github.com/sunkaifei/flycms
Events
Introduced
abbaa5a8daefb146ad4d61027035026b052cb414
Last Affected
abbaa5a8daefb146ad4d61027035026b052cb414
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "abbaa5a8daefb146ad4d61027035026b052cb414"
                },
                {
                    "last_affected":  "abbaa5a8daefb146ad4d61027035026b052cb414"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        }
    ]
}

Affected versions

Other
abbaa5a8daefb146ad4d61027035026b052cb414

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15094.json"