CVE-2025-64048

EPSS 0.03%
Veröffentlicht 24.11.2025 00:00:00
Zuletzt bearbeitet 01.12.2025 16:00:29
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 5

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD

Diese Information steht angemeldeten Benutzern zur Verfügung.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Yccms ≫ Yccms Version3.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.03%	0.083

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	6.1	2.8	2.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://yccms.com

Broken Link

https://gist.github.com/b1uel0n3/8354650e683ffb0812bfe72b702b482d

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2025-64048

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-64048

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-64048

EUVD