CVE-2026-112030 Details
Description
A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is suggested to update the configuration settings. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability allowing the use of default passwords has been identified in the Diem Project framework, specifically in versions through 5.1.3. The issue arises in the file dmCorePlugin/lib/data/dmDataLoad.php, where the data loader creates a super-administrator account with the username 'admin' and the password 'admin' if the database connection password is empty. This vulnerability can be exploited remotely, granting unauthorized access to administrative functions.
It is recommended to update the database password before completing the installation process to prevent the default password from being used.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/diem-project/diem/ | [email protected] | ProductVendor |
| https://github.com/diem-project/diem/issues/453 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112030 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1008078 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421678 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421678/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1393 | Use of Default Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| diem-project diem | <= 5.1.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |