Not on CISA's list of exploited flaws, and not in the news we track.
0.48%
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-125384. Nothing runs until you send it.
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials, which carry every admin role and no forced password change, to fully control deployments that kept them.