CVE-2009-1771: Flyspeck CMS

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

index.php in Flyspeck CMS 6.8 does not require administrative authentication for the updateExistingContent action, which allows remote attackers to create or modify admin accounts via the (1) users[fullname], (2) users[email], (3) users[role_id], (4) users[username], and (5) users[password] parameters.

Affected products

• Flyspeck Flyspeck CMS: version 6.8 only

Published 2009-05-22. Last modified 2026-06-16.