YZ
Product
YzmCMS
50
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 10Medium 37Low 1
Watch
Add YzmCMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-10224 | 6.8 | Apr 19 | An issue was discovered in YzmCMS 3.8 Affected: 3.8 |
| CVE-2018-10223 | 6.8 | Apr 19 | An issue was discovered in YzmCMS 3.8 Affected: 3.8 |
| CVE-2020-20502 | 6.5 | Jun 20 | Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function Affected: 2.0 |
| CVE-2022-23887 | 6.5 | Jan 28 | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete Affected: 6.3 |
| CVE-2019-16678 | 6.5 | Sep 21 | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route Affected: 5.3 |
| CVE-2026-29933 | 6.1 | Mar 26 | A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the… Affected: 7.4 |
| CVE-2025-56304 | 6.1 | Sep 23 | Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page Affected: through 7.3 |
| CVE-2025-3397 | 6.1 | Apr 8 | YzmCMS message.tpl cross site scripting Affected: 7.1 |
| CVE-2024-39174 | 6.1 | Jul 5 | A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… Affected: 7.1 |
| CVE-2024-24291 | 6.1 | Feb 6 | An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL Affected: 7.0 |
| CVE-2023-52274 | 6.1 | Jan 11 | member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header Affected: 6.5 through 7.0 |
| CVE-2020-23369 | 6.1 | May 10 | In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3 Affected: 5.6 |
| CVE-2020-18084 | 6.1 | Apr 30 | Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component… Affected: 5.2 |
| CVE-2020-22394 | 6.1 | Nov 19 | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability Affected: 5.5 |
| CVE-2019-16532 | 6.1 | Sep 26 | An HTTP Host header injection vulnerability exists in YzmCMS V5.3 Affected: 5.3 |
| CVE-2018-19092 | 6.1 | Nov 7 | An issue was discovered in YzmCMS v5.2 Affected: 5.2 |
| CVE-2018-7653 | 6.1 | Mar 4 | In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter Affected: 3.6 |
| CVE-2026-13529 | 5.6 | Jun 29 | YzmCMS index.php sql injection Affected: 7.0; 7.1; 7.2; 7.3; 7.4; 7.5 |
| CVE-2024-35110 | 5.5 | May 17 | A reflected XSS vulnerability has been found in YzmCMS 7.1 Affected: 7.1 |
| CVE-2021-36712 | 5.4 | Feb 3 | Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function Affected: 6.1 |
| CVE-2020-19118 | 5.4 | Jul 30 | Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html Affected: 5.2 |
| CVE-2020-35971 | 5.4 | Jun 3 | A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user_config_edit.html… Affected: 5.8 |
| CVE-2020-23370 | 5.4 | May 10 | In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file Affected: 5.6 |
| CVE-2018-16247 | 5.4 | Jun 20 | YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter Affected: 5.1 |
| CVE-2018-8078 | 5.4 | Mar 13 | YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html Affected: 3.7 |
| CVE-2022-23889 | 5.3 | Jan 28 | The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments Affected: 6.3 |
| CVE-2018-7479 | 5.3 | Feb 26 | YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php Affected: 3.6 |
| CVE-2020-19950 | 4.8 | Sep 23 | A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML Affected: 5.3 |
| CVE-2020-19949 | 4.8 | Sep 23 | A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML Affected: 5.3 |
| CVE-2019-9661 | 4.8 | Mar 11 | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter, Affected: 5.2 |
| CVE-2019-9660 | 4.8 | Mar 11 | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter Affected: 5.2 |
| CVE-2019-9570 | 4.8 | Mar 5 | An issue was discovered in YzmCMS 5.2.0 Affected: 5.2.0 |
| CVE-2018-19849 | 4.8 | Dec 4 | An issue was discovered in YzmCMS 5.2 Affected: 5.2 |
| CVE-2018-17044 | 4.8 | Sep 14 | In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter Affected: 5.1 |
| CVE-2018-10026 | 4.8 | Apr 11 | The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in… Affected: 3.7.1 |
| CVE-2026-15202 | 4.3 | Jul 9 | YzmCMS Header yzmphp.php get_url cross site scripting Affected: 7.0; 7.1; 7.2; 7.3; 7.4; 7.5 |
| CVE-2020-35972 | 4.3 | Jun 3 | An issue was discovered in YzmCMS V5.8 Affected: 5.8 |
Showing 37