Vendors / Xyhcms Records 3 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 1
Exploited now Xyhcms records in CISA KEV No Xyhcms vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority LOW 39
xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00494 · Published 2018-07-24 · No fix listed CWE-352
Priority LOW 25
XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0045 · Published 2021-10-06 · No fix listed CWE-79
Priority LOW 21
A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password.
CVSS 3.1 MEDIUM 4.5· Network · High privileges · User interaction · EPSS 0.00392 · Published 2021-07-08 · No fix listed CWE-352
Open these records in search → All records by CVSS severity
0 1 2 0 0
THREATIST.IORead the docs