youdiancms records

12 published records for vendor youdiancms.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

12 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-32301No exploit	YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.pyoudiancms · youdiancms · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.0%	Jun 15, 2022
39Monitor	CVE-2024-57052No exploit	An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php fileyoudiancms · youdiancms · CWE-384 Pre-auth	Critical9.8	—	0.5%	Jan 27, 2025
35Monitor	CVE-2022-32300No exploit	YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.cyoudiancms · youdiancms · CWE-89 SQL injection	High8.8	—	1.3%	Jun 15, 2022
35Monitor	CVE-2020-18116No exploit	A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection.youdiancms · youdiancms · CWE-89 SQL injection	High8.8	—	1.1%	Aug 27, 2021
35Monitor	CVE-2022-32299No exploit	YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Action/Admin/SiteAction.class.phpyoudiancms · youdiancms · CWE-89 SQL injection	High8.8	—	1.0%	Jun 15, 2022
27Monitor	CVE-2024-7328No exploit	YouDianCMS information disclosureyoudiancms · youdiancms · CWE-200 Pre-auth Info leak	Medium6.9	—	0.6%	Jul 31, 2024
21Monitor	CVE-2024-7329No exploit	YouDianCMS image_upload.php unrestricted uploadyoudiancms · youdiancms · CWE-434 File upload	Medium5.3	—	0.6%	Jul 31, 2024
21Monitor	CVE-2024-7330No exploit	YouDianCMS ydLib.php curl_exec server-side request forgeryyoudiancms · youdiancms · CWE-918 SSRF	Medium5.3	—	0.4%	Jul 31, 2024
21Monitor	CVE-2025-3531No exploit	YouDianCMS index.html cross site scriptingyoudiancms · youdiancms · CWE-79 Pre-auth XSS	Medium5.3	—	0.4%	Apr 13, 2025
21Monitor	CVE-2025-3532No exploit	YouDianCMS index.html.Attackers cross site scriptingyoudiancms · youdiancms · CWE-79 Pre-auth XSS	Medium5.3	—	0.4%	Apr 13, 2025
21Monitor	CVE-2025-3533No exploit	YouDianCMS index.html.Attackers cross site scriptingyoudiancms · youdiancms · CWE-79 Pre-auth XSS	Medium5.3	—	0.4%	Apr 13, 2025
18Monitor	CVE-2024-3117No exploit	YouDianCMS ChannelAction.class.php unrestricted uploadyoudiancms · youdiancms · CWE-434 File upload	Medium4.7	—	0.6%	Mar 30, 2024

CVE-2022-32301
39Monitor
YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.p
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
youdiancms · youdiancmsJun 15, 2022
CVE-2024-57052
39Monitor
An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
youdiancms · youdiancmsJan 27, 2025
CVE-2022-32300
35Monitor
YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.c
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
youdiancms · youdiancmsJun 15, 2022
CVE-2020-18116
35Monitor
A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection.
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
youdiancms · youdiancmsAug 27, 2021
CVE-2022-32299
35Monitor
YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Action/Admin/SiteAction.class.php
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
youdiancms · youdiancmsJun 15, 2022
CVE-2024-7328
27Monitor
YouDianCMS information disclosure
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Info leak
youdiancms · youdiancmsJul 31, 2024
CVE-2024-7329
21Monitor
YouDianCMS image_upload.php unrestricted upload
MediumCVSS 5.3No exploitEPSS 0%
- File upload
youdiancms · youdiancmsJul 31, 2024
CVE-2024-7330
21Monitor
YouDianCMS ydLib.php curl_exec server-side request forgery
MediumCVSS 5.3No exploitEPSS 0%
- SSRF
youdiancms · youdiancmsJul 31, 2024
CVE-2025-3531
21Monitor
YouDianCMS index.html cross site scripting
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- XSS
youdiancms · youdiancmsApr 13, 2025
CVE-2025-3532
21Monitor
YouDianCMS index.html.Attackers cross site scripting
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- XSS
youdiancms · youdiancmsApr 13, 2025
CVE-2025-3533
21Monitor
YouDianCMS index.html.Attackers cross site scripting
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- XSS
youdiancms · youdiancmsApr 13, 2025
CVE-2024-3117
18Monitor
YouDianCMS ChannelAction.class.php unrestricted upload
MediumCVSS 4.7No exploitEPSS 0%
- File upload
youdiancms · youdiancmsMar 30, 2024