CVE-2026-125384

EUVD-2026-120547
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 41.63%
Common Weakness Enumeration
References
https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System
https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/blob/v9.20250118/Infrastructure/Infrastructure/SeedManager/Systems/UserAdminSeeder.cs
https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/65609b5b88cb4f156e8164f33b8db8c63f5c125b
https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/commit/ded7d8a9457c780dfd4f5ea74d7e72111fafaea6
https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/issues/48
https://github.com/go2ismail/Asp.Net-Core-Inventory-Order-Management-System/releases/tag/v10.20261109
https://www.vulncheck.com/advisories/indotalent-whms-before-10.20261109-default-administrator-credentials-via-useradminseeder