by Kastro
Paper/Archive/CVE-2026-125384

CVE-2026-125384

go2ismail Asp.Net-Core-Inventory-Order-Management-System — INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder

CVSS 9.8
critical.is priorityof 100
29
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.

Affected

ProductAffectedFixed inSource
Asp.Net-Core-Inventory-Order-Management-System< 10.2026110910.20261109CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

refgithub.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/issues/48refgithub.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-Systemwriteupgithub.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/blob/v9.20250118/Infrastructure/Infrastructure/SeedManager/Systems/UserAdminSeeder.cspatchgithub.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/65609b5b88cb4f156e8164f33b8db8c63f5c125bpatchgithub.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/ded7d8a9457c780dfd4f5ea74d7e72111fafaea6refgithub.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/releases/tag/v10.20261109writeupvulncheck.com/advisories/indotalent-whms-before-10.20261109-default-administrator-credentials-via-useradminseeder