Priority HIGH 78
XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00456 · Published 2025-12-03 · No fix listed CWE-611
Priority HIGH 73
EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00284 · Published 2022-11-14 · No fix listed CWE-352
Priority HIGH 73
EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Top Up Balance component under the Edit Member module.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00404 · Published 2022-11-14 · No fix listed CWE-352
Priority HIGH 71
A vulnerability was found in EyouCMS 1.6.5.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00717 · Published 2024-04-07 · No fix listed CWE-502
Priority HIGH 71
EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points Recharge components.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00481 · Published 2022-10-18 · No fix listed CWE-352
Priority MEDIUM 63
eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.24931 · Published 2023-07-20 · No fix listed CWE-668
Priority MEDIUM 60
EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00256 · Published 2025-08-07 · No fix listed CWE-79
Priority MEDIUM 60
Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00458 · Published 2024-02-01 · No fix listed CWE-79
Priority MEDIUM 60
Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00458 · Published 2024-02-01 · No fix listed CWE-79
Priority MEDIUM 60
Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00458 · Published 2024-02-01 · No fix listed CWE-79
Priority MEDIUM 60
Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01019 · Published 2024-02-01 · No fix listed CWE-79
Priority MEDIUM 60
EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00418 · Published 2023-04-28 · No fix listed CWE-79
Priority MEDIUM 60
EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00422 · Published 2023-01-20 · No fix listed CWE-79
Priority MEDIUM 60
EyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-8 char.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00422 · Published 2023-01-20 · No fix listed CWE-79
Priority MEDIUM 60
EyouCMS <= 1.6.0 was discovered a reflected-XSS in FileManager component in GET value "activepath" when creating a new file.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00422 · Published 2023-01-20 · No fix listed CWE-79
Priority MEDIUM 60
EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_GOBACK_URL".
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00422 · Published 2023-01-20 · No fix listed CWE-79
Priority MEDIUM 60
EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_LIST_URL".
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00422 · Published 2023-01-20 · No fix listed CWE-79
Priority MEDIUM 58
eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00409 · Published 2023-11-21 · No fix listed CWE-79
Priority MEDIUM 58
There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00384 · Published 2023-06-22 · No fix listed CWE-79
Priority MEDIUM 58
EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00343 · Published 2023-06-12 · No fix listed CWE-79
Priority MEDIUM 58
Cross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the basic information page.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00447 · Published 2023-02-08 · No fix listed CWE-79
Priority MEDIUM 58
EyouCMS <= 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00388 · Published 2023-01-20 · No fix listed CWE-79
Priority MEDIUM 58
A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00373 · Published 2022-11-23 · No fix listed CWE-79
Priority MEDIUM 57
A flaw has been found in EyouCMS up to 1.7.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00451 · Published 2025-12-31 · No fix listed CWE-20
Priority MEDIUM 57
A security vulnerability has been detected in EyouCMS up to 1.7.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00256 · Published 2025-12-31 · No fix listed CWE-918
Load more
THREATIST.IORead the docs