Priority HIGH 73
Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00531 · Published 2023-08-11 · No fix listed CWE-352
Priority MEDIUM 64
Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00351 · Published 2024-05-06 · No fix listed CWE-79
Priority MEDIUM 60
A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referrer valu…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00198 · Published 2026-03-26 · No fix listed CWE-79
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00292 · Published 2024-07-05 · No fix listed CWE-79
Priority MEDIUM 58
A reflected XSS vulnerability has been found in YzmCMS 7.1.
CVSS 3.1MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.00294 · Published 2024-05-17 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability classified as problematic has been found in YzmCMS 7.1.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00555 · Published 2025-04-08 · No fix listed CWE-79
Priority MEDIUM 45
The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01414 · Published 2018-06-05 · No fix listed CWE-200
Priority MEDIUM 42
YzmCMS v6.3 is affected by broken access control.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01202 · Published 2022-03-07 · No fix listed CWE-287
Priority MEDIUM 40
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0082 · Published 2022-01-28 · No fix listed CWE-352
Priority LOW 39
YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00543 · Published 2022-02-15 · No fix listed CWE-352
Priority LOW 39
A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00561 · Published 2021-09-23 · No fix listed CWE-352
Priority LOW 39
YzmCMS v5.2 has admin/role/add.html CSRF.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00523 · Published 2018-12-10 · No fix listed CWE-352
Priority LOW 38
In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.07854 · Published 2018-03-04 · No fix listed CWE-79
Priority LOW 37
Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=member_content&a=init request.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0328 · Published 2018-03-18 · No fix listed CWE-94
Priority LOW 36
An issue was discovered in YzmCMS 5.8.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01317 · Published 2021-06-03 · No fix listed CWE-918
Priority LOW 36
YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01317 · Published 2021-09-01 · No fix listed CWE-918
Priority LOW 34
\application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/update_category_url.html.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00966 · Published 2018-03-01 · No fix listed CWE-89
Priority LOW 31
An issue was discovered in YzmCMS 3.8.
CVSS 3.0MEDIUM 6.8· Network · High privileges · User interaction · EPSS 0.0048 · Published 2018-04-19 · No fix listed CWE-352
Priority LOW 31
An issue was discovered in YzmCMS 3.8.
CVSS 3.0MEDIUM 6.8· Network · High privileges · User interaction · EPSS 0.0048 · Published 2018-04-19 · No fix listed CWE-352
Priority LOW 30
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00739 · Published 2022-01-28 · No fix listed CWE-352
Priority LOW 30
Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01315 · Published 2021-04-30 · No fix listed CWE-79
Priority LOW 30
admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00659 · Published 2019-09-21 · No fix listed CWE-352
Priority LOW 30
An HTTP Host header injection vulnerability exists in YzmCMS V5.3.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01221 · Published 2019-09-26 · No fix listed CWE-74
Priority LOW 29
In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00873 · Published 2021-05-10 · No fix listed CWE-79
Priority LOW 29
In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00733 · Published 2020-11-19 · No fix listed CWE-79
Load more
THREATIST.IORead the docs