CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/06/2021 |
| CVE-2020-23370 | MÉDIO5.4 | In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML. | 10/05/2021 |
| CVE-2020-23369 | MÉDIO6.1 | In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. | 10/05/2021 |
| CVE-2020-18084 | MÉDIO6.1 | Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in. | 30/04/2021 |
| CVE-2020-22394 | MÉDIO6.1 | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. | 19/11/2020 |
| CVE-2019-16532 | MÉDIO6.1 | An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections. | 26/09/2019 |
| CVE-2019-16678 | MÉDIO6.5 | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. | 21/09/2019 |
| CVE-2018-16247 | MÉDIO5.4 | YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter. | 20/06/2019 |
| CVE-2019-9661 | MÉDIO4.8 | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter, | 11/03/2019 |
| CVE-2019-9660 | MÉDIO4.8 | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter. | 11/03/2019 |
| CVE-2019-9570 | MÉDIO4.8 | An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. | 05/03/2019 |
| CVE-2018-20015 | ALTO8.8 | YzmCMS v5.2 has admin/role/add.html CSRF. | 10/12/2018 |
| CVE-2018-19849 | MÉDIO4.8 | An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter. | 04/12/2018 |
| CVE-2018-19092 | MÉDIO6.1 | An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie. | 07/11/2018 |
| CVE-2018-17044 | MÉDIO4.8 | In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter. | 14/09/2018 |
| CVE-2018-11554 | CRÍTICO9.8 | The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach. | 05/06/2018 |
| CVE-2018-10224 | MÉDIO6.8 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. | 19/04/2018 |