Vulnerabilities

TI-2026-00836 CVE-2026-1107 · GHSA-gcwp-v2vv-8h27

EyouCMS Member Avatar Diyajax.php check_userinfo unrestricted upload

LOW 25

A weakness has been identified in EyouCMS up to 1.7.1/5.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0052 Published 2026-01-18 No fix listed CWE-284

TI-2025-14024 CVE-2025-15375 · GHSA-vwg9-2rf4-w4xc

EyouCMS arcpagelist Ajax.php unserialize deserialization

MEDIUM 57

A flaw has been found in EyouCMS up to 1.7.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00451 Published 2025-12-31 No fix listed CWE-20

TI-2025-14023 CVE-2025-15374 · GHSA-r9h3-v9hv-vpf2

EyouCMS Ask Module Ask.php cross site scripting

MEDIUM 56

A vulnerability was detected in EyouCMS up to 1.7.7.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00256 Published 2025-12-31 No fix listed CWE-79

TI-2025-14022 CVE-2025-15373 · GHSA-93v3-46mj-22fw

EyouCMS function.php saveRemote server-side request forgery

MEDIUM 57

A security vulnerability has been detected in EyouCMS up to 1.7.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00256 Published 2025-12-31 No fix listed CWE-918

TI-2025-13821 CVE-2025-15143 · GHSA-6w66-j7h2-8jjr

EyouCMS Backend Template Management FilemanagerLogic.php sql injection

MEDIUM 56

A security flaw has been discovered in EyouCMS up to 1.7.6.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00382 Published 2025-12-28 No fix listed CWE-74

TI-2025-40489 CVE-2025-65868 · GHSA-27fc-mjrp-6g7x

XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a…

HIGH 78

XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00456 Published 2025-12-03 No fix listed CWE-611

TI-2025-32530 CVE-2025-52335 · GHSA-7hv5-v8qf-r822

EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be…

LOW 27

EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00212 Published 2025-08-14 No fix listed CWE-79

TI-2024-35273 CVE-2024-52680 · GHSA-84pm-7fpq-2j5v

EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.

MEDIUM 60

EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00256 Published 2025-08-07 No fix listed CWE-79

TI-2024-10385 CVE-2024-11211 · GHSA-99xc-66p2-xpcg

EyouCMS Website Logo unrestricted upload

LOW 24

A vulnerability classified as critical has been found in EyouCMS up to 1.6.7.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00616 Published 2024-11-14 No fix listed CWE-284

TI-2024-10384 CVE-2024-11210 · GHSA-7ggv-q84j-cmmr

EyouCMS FilemanagerLogic.php editFile path traversal

MEDIUM 57

A vulnerability was found in EyouCMS 1.51.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00639 Published 2024-11-14 No fix listed CWE-22

TI-2024-32298 CVE-2024-48196 · GHSA-fwvx-h53h-63j5

An issue in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via…

MEDIUM 40

An issue in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00533 Published 2024-10-28 No fix listed

TI-2024-32297 CVE-2024-48195 · GHSA-95jc-3vhv-3739

Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain…

LOW 27

Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00405 Published 2024-10-28 No fix listed CWE-79

TI-2024-03201 CVE-2024-3431 · GHSA-g6h9-ww5f-gjp4

EyouCMS Backend deserialization

HIGH 71

A vulnerability was found in EyouCMS 1.6.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00717 Published 2024-04-07 No fix listed CWE-502

TI-2023-22555 CVE-2023-42286 · GHSA-95wf-ppr8-fpf4

There is a PHP file inclusion vulnerability in the template configuration of eyoucms…

MEDIUM 51

There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a carefully crafted malicious payload.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00982 Published 2024-03-14 No fix listed CWE-434

TI-2024-15202 CVE-2024-23034 · GHSA-w636-mh7p-cc94

Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a…

MEDIUM 60

Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2024-02-01 No fix listed CWE-79

TI-2024-15201 CVE-2024-23033 · GHSA-8rwf-rv67-3ch6

Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a…

MEDIUM 60

Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2024-02-01 No fix listed CWE-79

TI-2024-15200 CVE-2024-23032 · GHSA-h7cg-cp8w-6f8h

Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote…

MEDIUM 60

Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00458 Published 2024-02-01 No fix listed CWE-79

TI-2024-15199 CVE-2024-23031 · GHSA-mwrc-5q9v-5658

Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows…

LOW 28

Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00434 Published 2024-02-01 No fix listed CWE-79

TI-2024-15188 CVE-2024-22927 · GHSA-qh6x-9qph-mmv5

Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows…

MEDIUM 60

Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01019 Published 2024-02-01 No fix listed CWE-79

TI-2023-27625 CVE-2023-50566 · GHSA-p25g-chfp-cx26

A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows…

LOW 25

A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Registration Number parameter…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00375 Published 2023-12-14 No fix listed CWE-79

TI-2023-26670 CVE-2023-48882 · GHSA-f4g6-w3rg-pwjc

A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows…

LOW 22

A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Document Properties field at /login.php m=adm…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00394 Published 2023-11-29 No fix listed CWE-79

TI-2023-26669 CVE-2023-48881 · GHSA-2539-c345-jfjh

A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows…

LOW 22

A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Fie…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00384 Published 2023-11-29 No fix listed CWE-79

TI-2023-26668 CVE-2023-48880 · GHSA-47jh-phv8-4gm6

A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows…

MEDIUM 55

A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu Name field at /login.php?m=admin&c=Index…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00443 Published 2023-11-29 No fix listed CWE-79

TI-2023-25342 CVE-2023-46935 · GHSA-xq3h-x3cq-7r9q

eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing…

MEDIUM 58

eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00409 Published 2023-11-21 No fix listed CWE-79

TI-2023-22043 CVE-2023-41597 · GHSA-62r3-vg25-3f7r

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS)…

LOW 30

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01224 Published 2023-11-15 No fix listed CWE-79

Vulnerabilities

Filters