CVE-2026-29933 | Medium | 6.1 | 2026-03-26 | A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the… |
CVE-2025-56304 | Medium | 6.1 | 2025-09-23 | Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page. |
CVE-2025-3397 | Medium | 4.3 | 2025-04-08 | A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argume… |
CVE-2024-39174 | Medium | 6.1 | 2024-07-05 | A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2024-35110 | Medium | 5.5 | 2024-05-17 | A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a… |
CVE-2024-28725 | High | 7.1 | 2024-05-06 | Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings. |
CVE-2024-24291 | Medium | 6.1 | 2024-02-06 | An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL. |
CVE-2023-52274 | Medium | 6.1 | 2024-01-11 | member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header. |
CVE-2020-23595 | High | 8.8 | 2023-08-11 | Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/… |
CVE-2020-20502 | Medium | 6.5 | 2023-06-20 | Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function. |
CVE-2021-36712 | Medium | 5.4 | 2023-02-03 | Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function. |
CVE-2022-23383 | Critical | 9.1 | 2022-03-10 | YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge… |
CVE-2022-23384 | High | 8.8 | 2022-02-15 | YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add |
CVE-2022-23889 | Medium | 5.3 | 2022-01-28 | The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comment… |
CVE-2022-23888 | High | 8.8 | 2022-01-28 | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html. |
CVE-2022-23887 | Medium | 6.5 | 2022-01-28 | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/de… |
CVE-2020-19951 | High | 8.8 | 2021-09-23 | A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application. |
CVE-2020-19950 | Medium | 4.8 | 2021-09-23 | A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-19949 | Medium | 4.8 | 2021-09-23 | A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML. |
CVE-2020-20341 | High | 7.5 | 2021-09-01 | YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function. |
CVE-2020-19118 | Medium | 5.4 | 2021-07-30 | Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html. |
CVE-2020-35972 | Medium | 4.3 | 2021-06-03 | An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html. |
CVE-2020-35971 | Medium | 5.4 | 2021-06-03 | A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user… |
CVE-2020-35970 | High | 7.5 | 2021-06-03 | An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read. |
CVE-2020-23370 | Medium | 5.4 | 2021-05-10 | In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a sw… |
CVE-2020-23369 | Medium | 6.1 | 2021-05-10 | In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. |
CVE-2020-18084 | Medium | 6.1 | 2021-04-30 | Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to… |
CVE-2020-22394 | Medium | 6.1 | 2020-11-19 | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. |
CVE-2019-16532 | Medium | 6.1 | 2019-09-26 | An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections. |
CVE-2019-16678 | Medium | 6.5 | 2019-09-21 | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. |
CVE-2018-16247 | Medium | 5.4 | 2019-06-20 | YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter. |
CVE-2019-9661 | Medium | 4.8 | 2019-03-11 | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter, |
CVE-2019-9660 | Medium | 4.8 | 2019-03-11 | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter. |
CVE-2019-9570 | Medium | 4.8 | 2019-03-05 | An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. |
CVE-2018-20015 | High | 8.8 | 2018-12-10 | YzmCMS v5.2 has admin/role/add.html CSRF. |
CVE-2018-19849 | Medium | 4.8 | 2018-12-04 | An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter. |
CVE-2018-19092 | Medium | 6.1 | 2018-11-07 | An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526… |
CVE-2018-17044 | Medium | 4.8 | 2018-09-14 | In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter. |
CVE-2018-11554 | Critical | 9.8 | 2018-06-05 | The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and… |
CVE-2018-10224 | Medium | 6.8 | 2018-04-19 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. |
CVE-2018-10223 | Medium | 6.8 | 2018-04-19 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.html. |
CVE-2018-10026 | Medium | 4.8 | 2018-04-11 | The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/contr… |
CVE-2018-8756 | High | 7.2 | 2018-03-18 | Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST da… |
CVE-2018-8078 | Medium | 5.4 | 2018-03-13 | YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html. |
CVE-2018-7653 | Medium | 6.1 | 2018-03-04 | In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter. |
CVE-2018-7579 | High | 7.2 | 2018-03-01 | \application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/update_category_url.htm… |
CVE-2018-7479 | Medium | 5.3 | 2018-02-26 | YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php. |