CVE-2026-1107 | Medium | 6.3 | 2026-01-18 | A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function check_userinfo of the file Diyajax.php of the component Member Avatar Handl… |
CVE-2025-15375 | Medium | 6.3 | 2025-12-31 | A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component… |
CVE-2025-15374 | Low | 3.5 | 2025-12-31 | A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php of the component As… |
CVE-2025-15373 | Medium | 6.3 | 2025-12-31 | A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation… |
CVE-2025-15143 | Medium | 4.7 | 2025-12-28 | A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic/FilemanagerLogic.p… |
CVE-2025-65868 | High | 7.5 | 2025-12-03 | XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request. |
CVE-2025-52335 | Medium | 6.1 | 2025-08-14 | EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information. |
CVE-2024-52680 | Medium | 6.1 | 2025-08-07 | EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. |
CVE-2024-11211 | Medium | 4.7 | 2024-11-14 | A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo Handler. The manipu… |
CVE-2024-11210 | Medium | 5.4 | 2024-11-14 | A vulnerability was found in EyouCMS 1.51. It has been rated as critical. This issue affects the function editFile of the file application/admin/logic/Filemana… |
CVE-2024-48196 | High | 7.5 | 2024-10-28 | An issue in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter. |
CVE-2024-48195 | Medium | 6.1 | 2024-10-28 | Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter. |
CVE-2024-3431 | Medium | 4.7 | 2024-04-07 | A vulnerability was found in EyouCMS 1.6.5. It has been declared as critical. This vulnerability affects unknown code of the file /login.php?m=admin&c=Field&a=… |
CVE-2023-42286 | Critical | 9.8 | 2024-03-14 | There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a ca… |
CVE-2024-23034 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-23033 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-23032 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-23031 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2024-22927 | Medium | 6.1 | 2024-02-01 | Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. |
CVE-2023-50566 | Medium | 5.4 | 2023-12-14 | A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2023-48882 | Medium | 4.8 | 2023-11-29 | A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2023-48881 | Medium | 4.8 | 2023-11-29 | A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2023-48880 | Medium | 4.8 | 2023-11-29 | A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2023-46935 | Medium | 5.4 | 2023-11-21 | eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users. |
CVE-2023-41597 | Medium | 6.1 | 2023-11-15 | EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t. |
CVE-2023-37645 | Medium | 5.3 | 2023-07-20 | eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt. |
CVE-2023-37136 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts o… |
CVE-2023-37135 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2023-37134 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2023-37133 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2023-37132 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2023-36093 | Medium | 5.4 | 2023-06-22 | There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1… |
CVE-2023-34657 | Medium | 4.8 | 2023-06-19 | A stored cross-site scripting (XSS) vulnerability in Eyoucms v1.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2023-33492 | Medium | 5.4 | 2023-06-12 | EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-31708 | Medium | 4.3 | 2023-05-23 | A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to the Upload software… |
CVE-2023-30125 | Medium | 6.1 | 2023-04-28 | EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-2058 | Low | 2.4 | 2023-04-14 | A vulnerability was found in EyouCms up to 1.6.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2023-2057 | Low | 2.4 | 2023-04-14 | A vulnerability was found in EyouCms 1.5.4. It has been classified as problematic. Affected is an unknown function of the file login.php?m=admin&c=Arctype&a=ed… |
CVE-2023-1799 | Low | 3.5 | 2023-04-02 | A vulnerability, which was classified as problematic, was found in EyouCMS up to 1.5.4. This affects an unknown part of the file login.php. The manipulation of… |
CVE-2023-1798 | Low | 3.5 | 2023-04-02 | A vulnerability, which was classified as problematic, has been found in EyouCMS up to 1.5.4. Affected by this issue is some unknown functionality of the file l… |
CVE-2022-45755 | Medium | 5.4 | 2023-02-08 | Cross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the basic information pa… |
CVE-2022-45542 | Medium | 5.4 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file. |
CVE-2022-45541 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char. |
CVE-2022-45540 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-8 char. |
CVE-2022-45539 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in FileManager component in GET value "activepath" when creating a new file. |
CVE-2022-45538 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_GOBACK_URL". |
CVE-2022-45537 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_LIST_URL". |
CVE-2021-39428 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privilege via the filen… |
CVE-2022-45280 | Medium | 5.4 | 2022-11-23 | A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-44390 | Medium | 5.4 | 2022-11-14 | A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-44389 | Medium | 6.5 | 2022-11-14 | EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module. This vulnerability allows attackers to… |
CVE-2022-44387 | High | 8.8 | 2022-11-14 | EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module. |
CVE-2022-43323 | High | 8.8 | 2022-11-14 | EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Top Up Balance component under the Edit Member module. |
CVE-2022-41500 | High | 8.8 | 2022-10-18 | EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points Re… |
CVE-2022-36225 | High | 8.8 | 2022-08-19 | EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add. |
CVE-2022-35509 | Medium | 5.4 | 2022-08-10 | An issue was discovered in EyouCMS 1.5.8. There is a Storage XSS vulnerability that can allows an attacker to execute arbitrary Web scripts or HTML by injectin… |
CVE-2022-33122 | Medium | 4.8 | 2022-06-24 | A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2022-26273 | Critical | 9.8 | 2022-03-28 | EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities. |
CVE-2022-26279 | Critical | 9.8 | 2022-03-24 | EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata. |
CVE-2021-42194 | High | 7.2 | 2022-03-20 | The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, whic… |
CVE-2021-46255 | High | 8.1 | 2022-01-14 | eyouCMS V1.5.5-UTF8-SP3_1 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename. |
CVE-2020-24000 | Critical | 9.8 | 2021-11-03 | SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to inde… |
CVE-2021-39501 | Medium | 6.1 | 2021-09-07 | EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function. |
CVE-2021-39500 | High | 7.5 | 2021-09-07 | Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, type, nid an attacker can inject "../" t… |
CVE-2021-39499 | Medium | 6.1 | 2021-09-07 | A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` p… |
CVE-2021-39497 | Critical | 9.8 | 2021-09-07 | eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function. |
CVE-2021-39496 | Medium | 5.4 | 2021-09-07 | Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS. |
CVE-2020-20645 | Medium | 5.4 | 2021-08-19 | Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area. |
CVE-2020-20642 | High | 8.8 | 2021-08-19 | Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=n… |
CVE-2020-19669 | High | 8.8 | 2021-08-18 | Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin_add&lang=cn. |
CVE-2020-28146 | Medium | 6.1 | 2021-08-18 | Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter. |
CVE-2020-21930 | Medium | 5.4 | 2021-08-10 | A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or… |
CVE-2020-21929 | Medium | 5.4 | 2021-08-10 | A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts… |
CVE-2020-18129 | High | 8.8 | 2020-10-22 | A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php. |
CVE-2019-17430 | Medium | 6.1 | 2019-10-10 | EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter. |