CVE-2026-125384 INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-125384?
CVE-2026-125384 is a critical vulnerability in go2ismail Asp.Net-Core-Inventory-Order-Management-System, published on 9 Nov 2026.
Official description
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.
Weakness: CWE-1392
Which versions are affected by CVE-2026-125384?
How do I fix CVE-2026-125384?
No fix has been published for CVE-2026-125384 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-125384 being exploited?
There is no known exploitation of CVE-2026-125384 in the wild and no public exploit code.
Sources
Also known as GHSA-327x-q7fw-jw58.