CVE-2025-10710

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-10710", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-09-19T06:07:23.595Z", "datePublished": "2025-09-19T12:32:09.221Z", "dateUpdated": "2025-09-19T13:04:33.430Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-09-19T12:32:09.221Z"}, "title": "07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "n/a", "product": "07FLYCMS", "versions": [{"version": "20250831", "status": "affected"}]}, {"vendor": "n/a", "product": "07FLY-CMS", "versions": [{"version": "20250831", "status": "affected"}]}, {"vendor": "n/a", "product": "07FlyCRM", "versions": [{"version": "20250831", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This affects an unknown part of the file /index.php. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "In 07FLYCMS, 07FLY-CMS and 07FlyCRM bis 20250831 wurde eine Schwachstelle gefunden. Betroffen davon ist ein unbekannter Prozess der Datei /index.php. Mit der Manipulation des Arguments Name mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2025-09-19T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-09-19T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-09-19T08:13:02.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Zre0x1c (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.324998", "name": "VDB-324998 | 07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.324998", "name": "VDB-324998 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.644968", "name": "Submit #644968 | 07FLY Enterprise Management System S1 Basic Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/1276486/CVE/issues/11", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"references": [{"url": "https://github.com/1276486/CVE/issues/11", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-19T13:04:30.330914Z", "id": "CVE-2025-10710", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T13:04:33.430Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10710", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-19T13:04:30.330914Z"}}}], "references": [{"url": "https://github.com/1276486/CVE/issues/11", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-19T13:04:22.448Z"}}], "cna": {"title": "07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "Zre0x1c (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "n/a", "product": "07FLYCMS", "versions": [{"status": "affected", "version": "20250831"}]}, {"vendor": "n/a", "product": "07FLY-CMS", "versions": [{"status": "affected", "version": "20250831"}]}, {"vendor": "n/a", "product": "07FlyCRM", "versions": [{"status": "affected", "version": "20250831"}]}], "timeline": [{"lang": "en", "time": "2025-09-19T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-09-19T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-09-19T08:13:02.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.324998", "name": "VDB-324998 | 07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.324998", "name": "VDB-324998 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.644968", "name": "Submit #644968 | 07FLY Enterprise Management System S1 Basic Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/1276486/CVE/issues/11", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This affects an unknown part of the file /index.php. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "In 07FLYCMS, 07FLY-CMS and 07FlyCRM bis 20250831 wurde eine Schwachstelle gefunden. Betroffen davon ist ein unbekannter Prozess der Datei /index.php. Mit der Manipulation des Arguments Name mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-09-19T12:32:09.221Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10710", "state": "PUBLISHED", "dateUpdated": "2025-09-19T13:04:33.430Z", "dateReserved": "2025-09-19T06:07:23.595Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-09-19T12:32:09.221Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "07FLYCMS", "vendor": "n/a", "versions": [{"status": "affected", "version": "20250831"}]}, {"product": "07FLY-CMS", "vendor": "n/a", "versions": [{"status": "affected", "version": "20250831"}]}, {"product": "07FlyCRM", "vendor": "n/a", "versions": [{"status": "affected", "version": "20250831"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This affects an unknown part of the file /index.php. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado un fallo en 07FLYCMS, 07FLY-CMS y 07FlyCRM hasta el 20250831. Esto afecta una parte desconocida del archivo /index.PHP. Esta manipulaci\u00f3n del argumento Name causa cross site scripting. El ataque puede ser llevado a cabo de forma remota. El exploit ha sido publicado y puede ser utilizado. Este producto se publica bajo m\u00faltiples nombres. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2025-10710", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10710", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-19T13:04:30.330914Z", "version": "2.0.3"}}]}, "published": "2025-09-19T13:15:43.270", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/1276486/CVE/issues/11"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.324998"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.324998"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.644968"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/1276486/CVE/issues/11"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-09-22T10:00:01.018135+00:00", "updated": "2025-09-22T10:06:22.492907+00:00", "vendors": ["07fly", "07fly$PRODUCT$07fly-cms", "07fly$PRODUCT$07flycms", "07fly$PRODUCT$07flycrm"]}