Vulnerabilities

TI-2025-10204 CVE-2025-11136 · GHSA-32xq-c7f5-x98h

YiFang CMS Backend File.php webUploader unrestricted upload

MEDIUM 56

A flaw has been found in YiFang CMS up to 2.0.2.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00397 Published 2025-09-29 No fix listed CWE-284

TI-2025-08612 CVE-2025-9400 · GHSA-5q3f-j5cg-9xmv

MEDIUM 57

A flaw has been found in YiFang CMS up to 2.0.5.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00342 Published 2025-08-25 No fix listed CWE-284

TI-2025-08611 CVE-2025-9399 · GHSA-x9w6-w79w-w3r4

HIGH 65

A vulnerability was detected in YiFang CMS up to 2.0.5.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0035 Published 2025-08-25 No fix listed CWE-74

TI-2025-08610 CVE-2025-9398 · GHSA-r52m-38gf-wxcc

MEDIUM 64

A security vulnerability has been detected in YiFang CMS up to 2.0.5.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00507 Published 2025-08-24 No fix listed CWE-200

TI-2025-04835 CVE-2025-5383 · GHSA-w76q-396p-2mrw

MEDIUM 55

A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00287 Published 2025-05-31 No fix listed CWE-79

TI-2025-04833 CVE-2025-5381 · GHSA-cw9c-84f2-568f

MEDIUM 56

A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00709 Published 2025-05-31 No fix listed CWE-22

TI-2025-28891 CVE-2025-45887 · GHSA-px42-xr3h-wjv8

MEDIUM 48

Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0044 Published 2025-05-09 No fix listed CWE-918