Login Request a demo
YZ
Vendor
Yzmcms
1 product with CVEs on record
50
CVEs
0
On KEV
1
New 30D
Products
YZ
YzmCMS
Yzmcms
9.8
50 CVEs0 on KEV1 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-105156
YZ
YzmCMS
Yzmcms
3.7
0%
Oct 4YzmCMS MD5 system.func.php password weak password hash
CVE-2026-15202
YZ
YzmCMS
Yzmcms
4.3
0%
Jul 9YzmCMS Header yzmphp.php get_url cross site scripting
CVE-2026-13529
YZ
YzmCMS
Yzmcms
5.6
0%
Jun 29YzmCMS index.php sql injection
CVE-2026-29933
YZ
Yzmcms
Yzmcms
6.1
0%
Mar 26A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the…
CVE-2025-56304
YZ
Yzmcms
Yzmcms
6.1
0%
Sep 23Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page
CVE-2025-3397
YZ
Yzmcms
Yzmcms
6.1
1%
Apr 8YzmCMS message.tpl cross site scripting
CVE-2024-39174
YZ
Yzmcms
Yzmcms
6.1
0%
Jul 5A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected…
CVE-2024-35110
YZ
Yzmcms
Yzmcms
5.5
0%
May 17A reflected XSS vulnerability has been found in YzmCMS 7.1
CVE-2024-28725
YZ
Yzmcms
Yzmcms
7.1
0%
May 6Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings
CVE-2024-24291
YZ
Yzmcms
Yzmcms
6.1
0%
Feb 6An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL
CVE-2023-52274
YZ
Yzmcms
Yzmcms
6.1
0%
Jan 11member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header
CVE-2020-23595
YZ
Yzmcms
Yzmcms
8.8
1%
Aug 11Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint
CVE-2020-20502
YZ
Yzmcms
Yzmcms
6.5
0%
Jun 20Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function
CVE-2021-36712
YZ
Yzmcms
Yzmcms
5.4
0%
Feb 3Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function
CVE-2022-23383
YZ
Yzmcms
Yzmcms
9.1
1%
Mar 10YzmCMS v6.3 is affected by broken access control
CVE-2022-23384
YZ
Yzmcms
Yzmcms
8.8
1%
Feb 15YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add
CVE-2022-23889
YZ
Yzmcms
Yzmcms
5.3
1%
Jan 28The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments
CVE-2022-23888
YZ
Yzmcms
Yzmcms
8.8
1%
Jan 28YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html
CVE-2022-23887
YZ
Yzmcms
Yzmcms
6.5
1%
Jan 28YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete
CVE-2020-19951
YZ
Yzmcms
Yzmcms
8.8
1%
Sep 23A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application
CVE-2020-19950
YZ
Yzmcms
Yzmcms
4.8
1%
Sep 23A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML
CVE-2020-19949
YZ
Yzmcms
Yzmcms
4.8
1%
Sep 23A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML
CVE-2020-20341
YZ
Yzmcms
Yzmcms
7.5
1%
Sep 1YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function
CVE-2020-19118
YZ
Yzmcms
Yzmcms
5.4
1%
Jul 30Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html
CVE-2020-35972
YZ
Yzmcms
Yzmcms
4.3
1%
Jun 3An issue was discovered in YzmCMS V5.8
CVE-2020-35971
YZ
Yzmcms
Yzmcms
5.4
1%
Jun 3A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user_config_edit.html…
CVE-2020-35970
YZ
Yzmcms
Yzmcms
7.5
1%
Jun 3An issue was discovered in YzmCMS 5.8
CVE-2020-23370
YZ
Yzmcms
Yzmcms
5.4
1%
May 10In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file
CVE-2020-23369
YZ
Yzmcms
Yzmcms
6.1
1%
May 10In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3
CVE-2020-18084
YZ
Yzmcms
Yzmcms
6.1
1%
Apr 30Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component…
CVE-2020-22394
YZ
Yzmcms
Yzmcms
6.1
1%
Nov 19In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability
CVE-2019-16532
YZ
Yzmcms
Yzmcms
6.1
1%
Sep 26An HTTP Host header injection vulnerability exists in YzmCMS V5.3
CVE-2019-16678
YZ
Yzmcms
Yzmcms
6.5
1%
Sep 21admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route
CVE-2018-16247
YZ
Yzmcms
Yzmcms
5.4
1%
Jun 20YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter
CVE-2019-9661
YZ
Yzmcms
Yzmcms
4.8
1%
Mar 11Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter,
CVE-2019-9660
YZ
Yzmcms
Yzmcms
4.8
1%
Mar 11Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter
CVE-2019-9570
YZ
Yzmcms
Yzmcms
4.8
1%
Mar 5An issue was discovered in YzmCMS 5.2.0
CVE-2018-20015
YZ
Yzmcms
Yzmcms
8.8
1%
Dec 10YzmCMS v5.2 has admin/role/add.html CSRF
CVE-2018-19849
YZ
Yzmcms
Yzmcms
4.8
0%
Dec 4An issue was discovered in YzmCMS 5.2
CVE-2018-19092
YZ
Yzmcms
Yzmcms
6.1
1%
Nov 7An issue was discovered in YzmCMS v5.2
CVE-2018-17044
YZ
Yzmcms
Yzmcms
4.8
1%
Sep 14In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter
CVE-2018-11554
YZ
Yzmcms
Yzmcms
9.8
1%
Jun 5The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly…
CVE-2018-10224
YZ
Yzmcms
Yzmcms
6.8
0%
Apr 19An issue was discovered in YzmCMS 3.8
CVE-2018-10223
YZ
Yzmcms
Yzmcms
6.8
0%
Apr 19An issue was discovered in YzmCMS 3.8
CVE-2018-10026
YZ
Yzmcms
Yzmcms
4.8
1%
Apr 11The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in…
CVE-2018-8756
YZ
Yzmcms
Yzmcms
7.2
3%
Mar 18Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an…
CVE-2018-8078
YZ
Yzmcms
Yzmcms
5.4
1%
Mar 13YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html
CVE-2018-7653
YZ
Yzmcms
Yzmcms
6.1
8%
Mar 4In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter
CVE-2018-7579
YZ
Yzmcms
Yzmcms
7.2
1%
Mar 1\application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/update_category_url.html
CVE-2018-7479
YZ
Yzmcms
Yzmcms
5.3
2%
Feb 26YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php