CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/06/2021 |
| CVE-2020-23370 | 中危5.4 | In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML. | 10/05/2021 |
| CVE-2020-23369 | 中危6.1 | In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. | 10/05/2021 |
| CVE-2020-18084 | 中危6.1 | Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in. | 30/04/2021 |
| CVE-2020-22394 | 中危6.1 | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. | 19/11/2020 |
| CVE-2019-16532 | 中危6.1 | An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections. | 26/09/2019 |
| CVE-2019-16678 | 中危6.5 | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. | 21/09/2019 |
| CVE-2018-16247 | 中危5.4 | YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter. | 20/06/2019 |
| CVE-2019-9661 | 中危4.8 | Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter, | 11/03/2019 |
| CVE-2019-9660 | 中危4.8 | Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter. | 11/03/2019 |
| CVE-2019-9570 | 中危4.8 | An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. | 05/03/2019 |
| CVE-2018-20015 | 高危8.8 | YzmCMS v5.2 has admin/role/add.html CSRF. | 10/12/2018 |
| CVE-2018-19849 | 中危4.8 | An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter. | 04/12/2018 |
| CVE-2018-19092 | 中危6.1 | An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie. | 07/11/2018 |
| CVE-2018-17044 | 中危4.8 | In YzmCMS 5.1, stored XSS exists via the admin/system_manage/user_config_add.html title parameter. | 14/09/2018 |
| CVE-2018-11554 | 严重9.8 | The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach. | 05/06/2018 |
| CVE-2018-10224 | 中危6.8 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. | 19/04/2018 |