CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/06/2021 |
| CVE-2020-23370 | 보통5.4 | In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML. | 10/05/2021 |
| CVE-2020-23369 | 보통6.1 | In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. | 10/05/2021 |
| CVE-2020-18084 | 보통6.1 | Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in. | 30/04/2021 |
| CVE-2020-22394 | 보통6.1 | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. | 19/11/2020 |
| CVE-2019-16532 | 보통6.1 | An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections. | 26/09/2019 |
| CVE-2019-16678 | 보통6.5 | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. | 21/09/2019 |
| CVE-2018-16247 | 보통5.4 | YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter. | 20/06/2019 |
| CVE-2019-9661 | 보통4.8 | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter, | 11/03/2019 |
| CVE-2019-9660 | 보통4.8 | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter. | 11/03/2019 |
| CVE-2019-9570 | 보통4.8 | An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. | 05/03/2019 |
| CVE-2018-20015 | 높음8.8 | YzmCMS v5.2 has admin/role/add.html CSRF. | 10/12/2018 |
| CVE-2018-19849 | 보통4.8 | An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter. | 04/12/2018 |
| CVE-2018-19092 | 보통6.1 | An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie. | 07/11/2018 |
| CVE-2018-17044 | 보통4.8 | In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter. | 14/09/2018 |
| CVE-2018-11554 | 심각9.8 | The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach. | 05/06/2018 |
| CVE-2018-10224 | 보통6.8 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. | 19/04/2018 |