An unauthenticated stored cross‑site scripting flaw exists in the System Extension Module of 07FLYCMS, 07FLY-CMS and 07FlyCRM. By sending a crafted Title parameter to the /admin/SysModule/edit.html endpoint, an attacker can embed arbitrary JavaScript that is later served to any user who views the page. This enables session hijacking, credential theft, defacement or delivery of further malware. The vulnerability is a classic XSS weakness (CWE‑79) and potentially allows code injection (CWE‑94).

The flaw affects 07FLYCMS, 07FLY-CMS and 07FlyCRM up to and including version 1.2.9. These applications are distributed under multiple brand names and were not patched by the vendor as of the disclosure.

The CVSS score of 4.8 indicates a moderate severity; the EPSS score of less than 1% suggests a low probability of exploitation in the wild. However, because the exploit has already been released publicly and can be launched remotely without authentication, organizations using the affected versions face a non‑trivial risk of compromise. The impact is limited to the browsers of users who view the malicious page, but can be leveraged for broader attacks if further credentials are accessed.