Yzmcms

Yzmcms

45 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2025-3397

Exploit
  • EPSS 0.04%
  • Published 08.04.2025 01:31:07
  • Last modified 09.04.2025 14:37:11

A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argument gourl leads to cross site scripting. It is possible to launch the attack remotely. The e...

6.1

CVE-2024-39174

Exploit
  • EPSS 0.11%
  • Published 05.07.2024 18:15:32
  • Last modified 13.06.2025 14:40:01

A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article.

5.5

CVE-2024-35110

Exploit
  • EPSS 0.28%
  • Published 17.05.2024 08:15:06
  • Last modified 10.06.2025 18:32:58

A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a malicious link, their cookies can be captured by an attacker.

7.1

CVE-2024-28725

Exploit
  • EPSS 0.17%
  • Published 06.05.2024 21:15:48
  • Last modified 10.06.2025 19:42:27

Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings.

6.1

CVE-2024-24291

Exploit
  • EPSS 0.13%
  • Published 06.02.2024 16:15:52
  • Last modified 24.04.2025 16:15:27

An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL.

6.1

CVE-2023-52274

Exploit
  • EPSS 0.24%
  • Published 11.01.2024 03:15:10
  • Last modified 17.06.2025 16:15:30

member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.

8.8

CVE-2020-23595

Exploit
  • EPSS 0.29%
  • Published 11.08.2023 14:15:10
  • Last modified 21.11.2024 05:13:56

Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint.

6.5

CVE-2020-20502

Exploit
  • EPSS 0.35%
  • Published 20.06.2023 15:15:10
  • Last modified 10.12.2024 19:15:13

Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.

5.4

CVE-2021-36712

Exploit
  • EPSS 0.07%
  • Published 03.02.2023 18:15:11
  • Last modified 26.03.2025 17:15:23

Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function.

9.1

CVE-2022-23383

  • EPSS 0.33%
  • Published 10.03.2022 17:45:51
  • Last modified 21.11.2024 06:48:29

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can...