Skip to content
Noroxi

yzmcms records

47 published records for vendor yzmcms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
5
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

47 records
  • CVE-2018-11554
    39Monitor

    The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information

    CriticalCVSS 9.8No exploitEPSS 1%

    yzmcms · yzmcmsJun 5, 2018

  • CVE-2022-23383
    36Monitor

    YzmCMS v6.3 is affected by broken access control.

    CriticalCVSS 9.1No exploitEPSS 1%

    yzmcms · yzmcmsMar 10, 2022

  • CVE-2022-23888
    35Monitor

    YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.

    HighCVSS 8.8No exploitEPSS 0%

    yzmcms · yzmcmsJan 28, 2022

  • CVE-2020-19951
    35Monitor

    A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the appli

    HighCVSS 8.8No exploitEPSS 0%

    yzmcms · yzmcmsSep 23, 2021

  • CVE-2022-23384
    35Monitor

    YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add

    HighCVSS 8.8No exploitEPSS 0%

    yzmcms · yzmcmsFeb 15, 2022

  • CVE-2020-23595
    35Monitor

    Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive inf

    HighCVSS 8.8No exploitEPSS 0%

    yzmcms · yzmcmsAug 11, 2023

  • CVE-2018-20015
    35Monitor

    YzmCMS v5.2 has admin/role/add.html CSRF.

    HighCVSS 8.8No exploitEPSS 0%

    yzmcms · yzmcmsDec 10, 2018

  • CVE-2020-20341
    30Monitor

    YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.

    HighCVSS 7.5No exploitEPSS 1%

    yzmcms · yzmcmsSep 1, 2021

  • CVE-2020-35970
    30Monitor

    An issue was discovered in YzmCMS 5.8.

    HighCVSS 7.5No exploitEPSS 1%

    yzmcms · yzmcmsJun 3, 2021

  • CVE-2018-8756
    29Monitor

    Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP

    HighCVSS 7.2No exploitEPSS 3%

    yzmcms · yzmcmsMar 18, 2018

  • CVE-2018-7579
    28Monitor

    \application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/upda

    HighCVSS 7.2No exploitEPSS 0%

    yzmcms · yzmcmsMar 1, 2018

  • CVE-2024-28725
    28Monitor

    Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and S

    HighCVSS 7.1No exploitEPSS 0%

    yzmcms · yzmcmsMay 6, 2024

  • CVE-2018-10224
    27Monitor

    An issue was discovered in YzmCMS 3.8.

    MediumCVSS 6.8No exploitEPSS 0%

    yzmcms · yzmcmsApr 19, 2018

  • CVE-2018-10223
    27Monitor

    An issue was discovered in YzmCMS 3.8.

    MediumCVSS 6.8No exploitEPSS 0%

    yzmcms · yzmcmsApr 19, 2018

  • CVE-2018-7653
    26Monitor

    In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.

    MediumCVSS 6.1Proof of conceptEPSS 7%

    yzmcms · yzmcmsMar 4, 2018

  • CVE-2022-23887
    26Monitor

    YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /ad

    MediumCVSS 6.5No exploitEPSS 0%

    yzmcms · yzmcmsJan 28, 2022

  • CVE-2019-16678
    26Monitor

    admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.

    MediumCVSS 6.5No exploitEPSS 0%

    yzmcms · yzmcmsSep 21, 2019

  • CVE-2020-20502
    26Monitor

    Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.

    MediumCVSS 6.5No exploitEPSS 0%

    yzmcms · yzmcmsJun 20, 2023

  • CVE-2020-18084
    24Monitor

    Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field o

    MediumCVSS 6.1No exploitEPSS 1%

    yzmcms · yzmcmsApr 30, 2021

  • CVE-2019-16532
    24Monitor

    An HTTP Host header injection vulnerability exists in YzmCMS V5.3.

    MediumCVSS 6.1No exploitEPSS 1%

    yzmcms · yzmcmsSep 26, 2019

  • CVE-2020-23369
    24Monitor

    In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4

    MediumCVSS 6.1No exploitEPSS 0%

    yzmcms · yzmcmsMay 10, 2021

  • CVE-2018-19092
    24Monitor

    An issue was discovered in YzmCMS v5.2.

    MediumCVSS 6.1No exploitEPSS 0%

    yzmcms · yzmcmsNov 7, 2018

  • CVE-2020-22394
    24Monitor

    In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability.

    MediumCVSS 6.1No exploitEPSS 0%

    yzmcms · yzmcmsNov 19, 2020

  • CVE-2024-24291
    24Monitor

    An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL.

    MediumCVSS 6.1No exploitEPSS 0%

    yzmcms · yzmcmsFeb 6, 2024

  • CVE-2023-52274
    24Monitor

    member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.

    MediumCVSS 6.1No exploitEPSS 0%

    yzmcms · yzmcmsJan 10, 2024