Login Request a demo
YZ
Product
YzmCMS
by Yzmcms · last CVE Oct 4, 2026
50
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities50In the news0Timeline
Severity mix
Critical 2High 10Medium 37Low 1
Severity
All severities50Critical2High10Medium37Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add YzmCMS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-23595
8.8
1%
Aug 11
Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint
Affected: 5.6
CVE-2022-23384
8.8
1%
Feb 15
YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add
Affected: 6.3
CVE-2022-23888
8.8
1%
Jan 28
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html
Affected: 6.3
CVE-2020-19951
8.8
1%
Sep 23
A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application
Affected: 5.5
CVE-2018-20015
8.8
1%
Dec 10
YzmCMS v5.2 has admin/role/add.html CSRF
Affected: 5.2
CVE-2020-20341
7.5
1%
Sep 1
YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function
Affected: 5.5
CVE-2020-35970
7.5
1%
Jun 3
An issue was discovered in YzmCMS 5.8
Affected: 5.8
CVE-2018-8756
7.2
3%
Mar 18
Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an…
Affected: 3.7.1
CVE-2018-7579
7.2
1%
Mar 1
\application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/update_category_url.html
Affected: 3.6
CVE-2024-28725
7.1
0%
May 6
Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings
Affected: 7.0
Showing 10