| CVE-2020-19118 | MEDIO5.4 | Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html. | 30/07/2021 |
| CVE-2020-35972 | MEDIO4.3 | An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html. | 03/06/2021 |
| CVE-2020-35971 | MEDIO5.4 | A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user_config_edit.html page. | 03/06/2021 |
| CVE-2020-35970 | ALTO7.5 | An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read. | 03/06/2021 |
| CVE-2020-23370 | MEDIO5.4 | In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML. | 10/05/2021 |
| CVE-2020-23369 | MEDIO6.1 | In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. | 10/05/2021 |
| CVE-2020-18084 | MEDIO6.1 | Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in. | 30/04/2021 |
| CVE-2020-22394 | MEDIO6.1 | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. | 19/11/2020 |
| CVE-2019-16532 | MEDIO6.1 | An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections. | 26/09/2019 |
| CVE-2019-16678 | MEDIO6.5 | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. | 21/09/2019 |
| CVE-2018-16247 | MEDIO5.4 | YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter. | 20/06/2019 |
| CVE-2019-9661 | MEDIO4.8 | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter, | 11/03/2019 |
| CVE-2019-9660 | MEDIO4.8 | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter. | 11/03/2019 |
| CVE-2019-9570 | MEDIO4.8 | An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. | 05/03/2019 |
| CVE-2018-20015 | ALTO8.8 | YzmCMS v5.2 has admin/role/add.html CSRF. | 10/12/2018 |
| CVE-2018-19849 | MEDIO4.8 | An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter. | 04/12/2018 |
| CVE-2018-19092 | MEDIO6.1 | An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie. | 07/11/2018 |
| CVE-2018-17044 | MEDIO4.8 | In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter. | 14/09/2018 |
| CVE-2018-11554 | CRÍTICO9.8 | The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach. | 05/06/2018 |
| CVE-2018-10224 | MEDIO6.8 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. | 19/04/2018 |