What is CVE-2025-64048?

CVE-2025-64048 is a medium-severity vulnerability in Yccms, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-11-24.

How severe is CVE-2025-64048?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Yccms

CVE-2025-64048

YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (7.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Yccms — versions 3.4
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Broken Link)
cve@mitre.org (Third Party Advisory)

Frequently asked questions

What is CVE-2025-64048?: CVE-2025-64048 is a medium-severity vulnerability in Yccms, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-11-24.
How severe is CVE-2025-64048?: Medium severity. CVSS v3 base score is 6.1 out of 10.