Medium severity · published Jul 9, 2026
CVE-2026-15202
YzmCMS Header yzmphp.php get_url cross site scripting
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzmphp.php of the component Header Handler. The manipulation of the argument HTTP_HOST leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YZ
YzmCMS · Yzmcms
7.0; 7.1; 7.2; 7.3; 7.4; 7.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15202
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15202
gist.github.com
https://gist.github.com/188452/72d03d030ee3cbfee2642badfa9dce33
vuldb.com
https://vuldb.com/cve/CVE-2026-15202
vuldb.com
https://vuldb.com/submit/851931
vuldb.com
https://vuldb.com/vuln/377124
vuldb.com
https://vuldb.com/vuln/377124/cti
More from YzmCMS
9.8
CVE-2018-11554
The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly…
9.1
CVE-2022-23383
YzmCMS v6.3 is affected by broken access control
8.8
CVE-2020-23595
Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint
8.8
CVE-2022-23384
YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add
8.8
CVE-2022-23888
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html