Yzmcms

Yzmcms

46 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.1

CVE-2022-23383

  • EPSS 0.33%
  • Published 10.03.2022 17:45:51
  • Last modified 21.11.2024 06:48:29

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can...

8.8

CVE-2022-23384

Exploit
  • EPSS 0.13%
  • Published 15.02.2022 13:15:07
  • Last modified 21.11.2024 06:48:29

YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add

5.3

CVE-2022-23889

Exploit
  • EPSS 0.29%
  • Published 28.01.2022 21:15:10
  • Last modified 21.11.2024 06:49:25

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.

8.8

CVE-2022-23888

Exploit
  • EPSS 0.45%
  • Published 28.01.2022 21:15:10
  • Last modified 21.11.2024 06:49:25

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.

6.5

CVE-2022-23887

Exploit
  • EPSS 0.23%
  • Published 28.01.2022 21:15:10
  • Last modified 21.11.2024 06:49:24

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.

8.8

CVE-2020-19951

Exploit
  • EPSS 0.17%
  • Published 23.09.2021 20:15:07
  • Last modified 21.11.2024 05:09:30

A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application.

4.8

CVE-2020-19950

Exploit
  • EPSS 0.32%
  • Published 23.09.2021 20:15:07
  • Last modified 21.11.2024 05:09:30

A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML.

4.8

CVE-2020-19949

Exploit
  • EPSS 0.32%
  • Published 23.09.2021 20:15:07
  • Last modified 21.11.2024 05:09:29

A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML.

7.5

CVE-2020-20341

Exploit
  • EPSS 0.43%
  • Published 01.09.2021 20:15:07
  • Last modified 21.11.2024 05:12:01

YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.

5.4

CVE-2020-19118

Exploit
  • EPSS 0.24%
  • Published 30.07.2021 14:15:13
  • Last modified 21.11.2024 05:08:57

Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html.