Priority MEDIUM 60
A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referrer valu…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00198 · Published 2026-03-26 · No fix listed CWE-79
Priority LOW 27
Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00202 · Published 2025-09-23 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability classified as problematic has been found in YzmCMS 7.1.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00555 · Published 2025-04-08 · No fix listed CWE-79
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00292 · Published 2024-07-05 · No fix listed CWE-79
Priority MEDIUM 58
A reflected XSS vulnerability has been found in YzmCMS 7.1.
CVSS 3.1MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.00294 · Published 2024-05-17 · No fix listed CWE-79
Priority MEDIUM 64
Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00351 · Published 2024-05-06 · No fix listed CWE-79
Priority LOW 27
An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00388 · Published 2024-02-06 · No fix listed CWE-601
Priority LOW 27
member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00365 · Published 2024-01-11 · No fix listed CWE-79
Priority HIGH 73
Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00531 · Published 2023-08-11 · No fix listed CWE-352
Priority LOW 29
Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00465 · Published 2023-06-20 · No fix listed CWE-352
Priority LOW 25
Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00451 · Published 2023-02-03 · No fix listed CWE-79
Priority MEDIUM 42
YzmCMS v6.3 is affected by broken access control.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01202 · Published 2022-03-07 · No fix listed CWE-287
Priority LOW 39
YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00543 · Published 2022-02-15 · No fix listed CWE-352
Priority LOW 26
The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01082 · Published 2022-01-28 · No fix listed CWE-674
Priority MEDIUM 40
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0082 · Published 2022-01-28 · No fix listed CWE-352
Priority LOW 30
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00739 · Published 2022-01-28 · No fix listed CWE-352
Priority LOW 39
A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00561 · Published 2021-09-23 · No fix listed CWE-352
Priority LOW 23
A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00589 · Published 2021-09-23 · No fix listed CWE-79
Priority LOW 23
A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00589 · Published 2021-09-23 · No fix listed CWE-79
Priority LOW 36
YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01317 · Published 2021-09-01 · No fix listed CWE-918
Priority LOW 25
Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00524 · Published 2021-07-27 · No fix listed CWE-79
Priority LOW 36
An issue was discovered in YzmCMS 5.8.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01317 · Published 2021-06-03 · No fix listed CWE-918
Priority LOW 25
A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user_config_edit.html page.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00503 · Published 2021-06-03 · No fix listed CWE-79
Priority LOW 21
An issue was discovered in YzmCMS V5.8.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00566 · Published 2021-06-03 · No fix listed CWE-352
Priority LOW 29
In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00873 · Published 2021-05-10 · No fix listed CWE-79
Load more
THREATIST.IORead the docs