CVE-2026-2965 - 07FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scripting

Back Back to CVE browser

MEDIUM

07FLYCMS/07FLY-CMS/07FlyCRM System Extension edit.html cross site scripting

Published Feb 23, 2026

4.8

MEDIUM

CVSS 4.0

EPSS 0.36%

Description

A security flaw has been discovered in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.9. The affected element is an unknown function of the file /admin/SysModule/edit.html of the component System Extension Module. Performing a manipulation of the argument Title results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor n/a Product 07fly-Cms Default
n/a
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.2.1
  Status
  affected
  Constraints
  -
- Version
  1.2.2
  Status
  affected
  Constraints
  -
- Version
  1.2.3
  Status
  affected
  Constraints
  -
- Version
  1.2.4
  Status
  affected
  Constraints
  -
- Version
  1.2.5
  Status
  affected
  Constraints
  -
- Version
  1.2.6
  Status
  affected
  Constraints
  -
- Version
  1.2.7
  Status
  affected
  Constraints
  -
- Version
  1.2.8
  Status
  affected
  Constraints
  -
- Version
  1.2.9
  Status
  affected
  Constraints
  -
Vendor n/a Product 07flycms Default
n/a
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.2.1
  Status
  affected
  Constraints
  -
- Version
  1.2.2
  Status
  affected
  Constraints
  -
- Version
  1.2.3
  Status
  affected
  Constraints
  -
- Version
  1.2.4
  Status
  affected
  Constraints
  -
- Version
  1.2.5
  Status
  affected
  Constraints
  -
- Version
  1.2.6
  Status
  affected
  Constraints
  -
- Version
  1.2.7
  Status
  affected
  Constraints
  -
- Version
  1.2.8
  Status
  affected
  Constraints
  -
- Version
  1.2.9
  Status
  affected
  Constraints
  -
Vendor n/a Product 07FlyCRM Default
n/a
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.2.1
  Status
  affected
  Constraints
  -
- Version
  1.2.2
  Status
  affected
  Constraints
  -
- Version
  1.2.3
  Status
  affected
  Constraints
  -
- Version
  1.2.4
  Status
  affected
  Constraints
  -
- Version
  1.2.5
  Status
  affected
  Constraints
  -
- Version
  1.2.6
  Status
  affected
  Constraints
  -
- Version
  1.2.7
  Status
  affected
  Constraints
  -
- Version
  1.2.8
  Status
  affected
  Constraints
  -
- Version
  1.2.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

07fly-Cms

n/a

Version	Status	Constraints
1.2.0	affected	-
1.2.1	affected	-
1.2.2	affected	-
1.2.3	affected	-
1.2.4	affected	-
1.2.5	affected	-
1.2.6	affected	-
1.2.7	affected	-
1.2.8	affected	-
1.2.9	affected	-

n/a

07flycms

n/a

Version	Status	Constraints
1.2.0	affected	-
1.2.1	affected	-
1.2.2	affected	-
1.2.3	affected	-
1.2.4	affected	-
1.2.5	affected	-
1.2.6	affected	-
1.2.7	affected	-
1.2.8	affected	-
1.2.9	affected	-

n/a

07FlyCRM

n/a

Version	Status	Constraints
1.2.0	affected	-
1.2.1	affected	-
1.2.2	affected	-
1.2.3	affected	-
1.2.4	affected	-
1.2.5	affected	-
1.2.6	affected	-
1.2.7	affected	-
1.2.8	affected	-
1.2.9	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7600
Advisory
https://vuldb.com/?ctiid.347332
signaturepermissions-required
https://vuldb.com/?id.347332
vdb-entrytechnical-description
https://vuldb.com/?submit.755225
third-party-advisory
https://www.notion.so/07FlyCRM-Stored-Cross-Site-Scripting-XSS-in-SysModule-module-303ea92a3c4180d3a9a8e9f6c3d2915a?v=2ffea92a3c418057a8b7000c66564aa1
exploit

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7600		Advisory
https://vuldb.com/?ctiid.347332		signaturepermissions-required
https://vuldb.com/?id.347332		vdb-entrytechnical-description
https://vuldb.com/?submit.755225		third-party-advisory
https://www.notion.so/07FlyCRM-Stored-Cross-Site-Scripting-XSS-in-SysModule-module-303ea92a3c4180d3a9a8e9f6c3d2915a?v=2ffea92a3c418057a8b7000c66564aa1		exploit