CVE-2026-112030: medium-severity vulnerability in diem-project diem
diem-project diem dmDataLoad.php default password
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is suggested to update the configuration settings. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
diem-project · diempublic PoCs found — 1
cve_referencegithub.com/diem-project/diem/issues/453unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — diem-project diem
In the same product, most dangerous first.
CVE-2026-82678MEDIUMdiem-project diem Administrative Console actions.class.php executeCommand os command injectionEPSS 2.2%CVE-2026-86183MEDIUMdiem-project diem dmWidget BasedmWidgetActions.class.php authorizationEPSS 0.6%CVE-2026-82679MEDIUMdiem-project diem Widget Editor dmWidgetContentBaseMediaForm.php unrestricted uploadEPSS 0.4%CVE-2026-112138MEDIUMdiem-project diem dmCodeEditor actions.class.php join path traversalEPSS 0.3%CVE-2026-112041MEDIUMdiem-project diem dmString.php random weak prngEPSS 0.3%CVE-2026-112040MEDIUMdiem-project diem Sign-In BasedmUserActions.class.php redirectEPSS 0.3%