SQL Injection in 07fly-Cms
CVE-2025-10712
A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This issue affects some unknown processing of the file /index.php/Login/login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.
EPSS: 0.003 (22.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- N/a 07fly-cms — versions 20250831
- N/a 07flycms — versions 20250831
- N/a 07flycrm — versions 20250831
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, vdb-entry)
- cna@vuldb.com (signature, permissions-required)
- cna@vuldb.com (third-party-advisory)
- cna@vuldb.com (issue-tracking, exploit)
Frequently asked questions
- What is CVE-2025-10712?
- CVE-2025-10712 is a high-severity vulnerability in 07fly-Cms, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.3/10. Published 2025-09-19.
- How severe is CVE-2025-10712?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2025-10712 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.