Browse CVEs

MEDIUM 6.1 CVE-2026-29933 A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascri… Yzmcms No fix yet Fix from $1,6002026-03-26 MEDIUM 6.1 CVE-2025-56304 Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page. Yzmcms after 7.3 Fix from $1,6002025-09-23 MEDIUM 6.1 CVE-2025-3397 A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of … Yzmcms No fix yet Fix from $1,6002025-04-08 MEDIUM 6.1 CVE-2024-39174 A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML v… Yzmcms No fix yet Fix from $1,6002024-07-05 MEDIUM 5.5 CVE-2024-35110 A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users… Yzmcms No fix yet Fix from $1,6002024-05-17 HIGH 7.1 CVE-2024-28725 Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Set… Yzmcms No fix yet Fix from $1,9502024-05-06 MEDIUM 6.1 CVE-2024-24291 An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL. Yzmcms No fix yet Fix from $1,6002024-02-06 MEDIUM 6.1 CVE-2023-52274 member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header. Yzmcms after 7.0 Fix from $1,6002024-01-11 HIGH 8.8 CVE-2020-23595 Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information … Yzmcms No fix yet Fix from $1,9502023-08-11 MEDIUM 6.5 CVE-2020-20502 Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function. Yzmcms No fix yet Fix from $1,6002023-06-20 MEDIUM 5.4 CVE-2021-36712 Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function. Yzmcms No fix yet Fix from $1,6002023-02-03 CRITICAL 9.1 CVE-2022-23383 YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessar… Yzmcms Mitigation only Fix from $2,3002022-03-10 HIGH 8.8 CVE-2022-23384 YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add Yzmcms No fix yet Fix from $1,9502022-02-15 HIGH 8.8 CVE-2022-23888 YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html. Yzmcms No fix yet Fix from $1,9502022-01-28 MEDIUM 6.5 CVE-2022-23887 YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin… Yzmcms No fix yet Fix from $1,6002022-01-28 MEDIUM 5.3 CVE-2022-23889 The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number … Yzmcms No fix yet Fix from $1,6002022-01-28 HIGH 8.8 CVE-2020-19951 A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application. Yzmcms No fix yet Fix from $1,9502021-09-23 HIGH 7.5 CVE-2020-20341 YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function. Yzmcms No fix yet Fix from $1,9502021-09-01 MEDIUM 5.4 CVE-2020-19118 Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html. Yzmcms No fix yet Fix from $1,6002021-07-30 HIGH 7.5 CVE-2020-35970 An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read. Yzmcms No fix yet Fix from $1,9502021-06-03 MEDIUM 5.4 CVE-2020-35971 A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_m… Yzmcms No fix yet Fix from $1,6002021-06-03 MEDIUM 6.1 CVE-2020-23369 In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. Yzmcms No fix yet Fix from $1,6002021-05-10 MEDIUM 5.4 CVE-2020-23370 In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to u… Yzmcms No fix yet Fix from $1,6002021-05-10 MEDIUM 6.1 CVE-2020-18084 Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST … Yzmcms No fix yet Fix from $1,6002021-04-30 MEDIUM 6.1 CVE-2020-22394 In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. Yzmcms No fix yet Fix from $1,6002020-11-19 MEDIUM 6.1 CVE-2019-16532 An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections. Yzmcms No fix yet Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2019-16678 admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. Yzmcms No fix yet Fix from $1,6002019-09-21 MEDIUM 5.4 CVE-2018-16247 YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter. Yzmcms No fix yet Fix from $1,6002019-06-20 HIGH 8.8 CVE-2018-20015 YzmCMS v5.2 has admin/role/add.html CSRF. Yzmcms No fix yet Fix from $1,9502018-12-10 MEDIUM 6.1 CVE-2018-19092 An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pu… Yzmcms No fix yet Fix from $1,6002018-11-07