GCVE - cpe:2.3:a:yzmcms:yzmcms:3.6:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:yzmcms:yzmcms:3.6:*:*:*:*:*:*:*

part: a version: 3.6 update: *

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:github/yzmcms/yzmcms`	purl2cpe	2026-06-01 10:11:22.492259

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-7653`	vulnerable	2026-06-08 05:12:03.945459	Details available In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter. Published: 2018-03-04T19:00:00.000Z Updated: 2024-08-05T06:31:05.049Z Open on db.gcve.eu Reference links https://packetstormsecurity.com/files/147065/YzmCMS-3.6-Cross-Site-Scripting.html https://github.com/ponyma233/YzmCMS/blob/master/YzmCMS_3.6_bug.md https://www.exploit-db.com/exploits/44405/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-7579`	vulnerable	2026-06-08 05:12:03.902054	Details available \application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/update_urls/update_category_url.html. Published: 2018-03-01T18:00:00.000Z Updated: 2024-08-05T06:31:04.714Z Open on db.gcve.eu Reference links http://www.atksec.com/article/yzmcms-v3.6-sqli/index.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-7479`	vulnerable	2026-06-08 05:12:03.733804	Details available YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php. Published: 2018-02-26T03:00:00.000Z Updated: 2024-08-05T06:31:03.578Z Open on db.gcve.eu Reference links https://github.com/kongxin520/YzmCMS/blob/master/YzmCMS_3.6_bug.md https://kongxin.gitbook.io/yzmcms-3-6-bug/	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.