CVE-2026-2965 | 07FLYCMS/07FLY-CMS/07FlyCRM up to 1.2.9 System Extension edit.html Title cross site scripting

A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.9. It has been classified as problematic. The affected element is an unknown function of the file /admin/SysModule/edit.html of the component System Extension Module. Performing a manipulation of the argument Title results in cross site scripting.

This vulnerability is identified as CVE-2026-2965. The attack can be initiated remotely. Additionally, an exploit exists.

This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.