Vulnerabilities

TI-2020-14129 CVE-2020-21656 · GHSA-55xc-mp8m-rgvj

XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index.

LOW 25

XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0045 Published 2021-10-06 No fix listed CWE-79

TI-2020-13878 CVE-2020-20586 · GHSA-6qjf-g23v-vfj8

A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI…

LOW 21

A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password.

CVSS 3.1MEDIUM 4.5 Network High privileges User interaction EPSS 0.00392 Published 2021-07-08 No fix listed CWE-352

TI-2018-10451 CVE-2018-14583 · GHSA-fw5q-3wvv-p93w

xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account.

LOW 39

xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00494 Published 2018-07-24 No fix listed CWE-352

Vulnerabilities

Filters

XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index.

A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI…

xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account.