Yzmcms

A security vulnerability has been detected in YzmCMS up to 7.5. Affected is the function get_url of the file /yzmphp/yzmphp.php of the component Header Handler. The manipulation of the argument HTTP_HOST leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-07-09T17:30:07.209Z
Updated: 2026-07-09T18:27:56.467Z

A vulnerability was determined in YzmCMS up to 7.5. This affects an unknown function of the file /application/install/index.php. Executing a manipulation of the argument siteurl can lead to sql injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-06-29T03:00:08.284Z
Updated: 2026-06-29T12:58:10.965Z

Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page.

Published: 2025-09-23T00:00:00.000Z
Updated: 2026-07-05T01:12:17.665Z

member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.

Published: 2024-01-11T00:00:00.000Z
Updated: 2025-06-17T15:14:27.023Z

The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach.

Published: 2018-06-05T11:00:00.000Z
Updated: 2024-08-05T08:10:14.630Z