GCVE - cpe:2.3:a:wanglongcn:yifang:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wanglongcn:yifang:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Wanglongcn (`feb3b886-33ef-50c7-b846-79e5c1713413`)
Product	Yifang (`fd010bbe-3172-5c91-ae92-d5229ae81059`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-9400`	vulnerable	2026-06-08 07:45:22.426926	YiFang CMS P_file.php mergeMultipartUpload unrestricted upload MEDIUM (6.3) A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-08-25T00:32:06.112Z Updated: 2025-08-25T20:29:09.150Z Open on db.gcve.eu Reference links https://vuldb.com/?id.321236 https://vuldb.com/?ctiid.321236 https://vuldb.com/?submit.632535 https://github.com/August829/Yu/blob/main/20250811_3.md https://github.com/August829/Yu/blob/main/20250811_3.md#poc	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9399`	vulnerable	2026-06-08 07:45:22.426354	YiFang CMS L_tool.php sql injection MEDIUM (6.3) A vulnerability was detected in YiFang CMS up to 2.0.5. Affected by this issue is some unknown functionality of the file app/logic/L_tool.php. The manipulation of the argument new_url results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-08-25T00:02:05.588Z Updated: 2025-08-25T20:28:32.941Z Open on db.gcve.eu Reference links https://vuldb.com/?id.321235 https://vuldb.com/?ctiid.321235 https://vuldb.com/?submit.632534 https://github.com/August829/Yu/blob/main/20250811_4.md https://github.com/August829/Yu/blob/main/20250811_4.md#poc	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9398`	vulnerable	2026-06-08 07:45:22.425765	YiFang CMS Migrate.php exportInstallTable information disclosure MEDIUM (5.3) A security vulnerability has been detected in YiFang CMS up to 2.0.5. Affected by this vulnerability is the function exportInstallTable of the file app/utils/base/database/Migrate.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Published: 2025-08-24T23:32:06.686Z Updated: 2025-08-25T20:27:57.281Z Open on db.gcve.eu Reference links https://vuldb.com/?id.321234 https://vuldb.com/?ctiid.321234 https://vuldb.com/?submit.632533 https://github.com/August829/Yu/blob/main/20250811_5.md https://github.com/August829/Yu/blob/main/20250811_5.md#poc	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5383`	vulnerable	2026-06-08 07:37:24.133652	Yifang CMS Article Management Module cross site scripting LOW (2.4) A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic. Affected by this issue is some unknown functionality of the component Article Management Module. The manipulation of the argument Default Value leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Published: 2025-05-31T15:00:16.412Z Updated: 2025-06-02T15:47:33.395Z Open on db.gcve.eu Reference links https://vuldb.com/?id.310676 https://vuldb.com/?ctiid.310676 https://gitee.com/wanglongcn/yifang/issues/IC41YQ	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5381`	vulnerable	2026-06-08 07:35:24.809601	Yifang CMS Admin Panel downloadFile path traversal LOW (2.7) A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/downloadFile of the component Admin Panel. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Published: 2025-05-31T14:31:10.103Z Updated: 2025-06-02T15:47:39.708Z Open on db.gcve.eu Reference links https://vuldb.com/?id.310674 https://vuldb.com/?ctiid.310674 https://gitee.com/wanglongcn/yifang/issues/IC0RCX	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-11136`	vulnerable	2026-06-08 07:02:28.131635	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Yifang

Notes

PURL mappings

Vulnerability references

Contribute