CVE-2020-23595

Cross Site Request Forgery CSRF vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint...

CVE-2020-23595

Cross Site Request Forgery CSRF vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint...

PT-2023-11651 · Yzmcms · Yzmcms

Name of the Vulnerable Software and Affected Versions: yzmcms version 5.6 Description: The issue allows remote attackers to escalate privileges and gain sensitive information. This is achieved through a Cross Site Request Forgery CSRF vulnerability, specifically at the "sitemodel/add.html"...

Yzmcms 跨站请求伪造漏洞

Yzmcms is an open source CMS Content Management System for Yzmcms individual developers. A security vulnerability exists in Yzmcms version 2.0. Attackers use the vulnerability to execute arbitrary code through the token checking function...

Yzmcms Cross-Site Scripting Vulnerability (CNVD-2023-09601)

Yzmcms is an open source CMS Content Management System for Yzmcms individual developers. A cross-site scripting vulnerability exists in Yzmcms version 6.1. A remote attacker can exploit this vulnerability to steal user cookies via the image cutter function...

CVE-2021-36712

Cross Site Scripting XSS vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function...

CVE-2021-36712

Cross Site Scripting XSS vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function...

Cross site scripting

Cross Site Scripting XSS vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function...

CVE-2021-36712

Summary: CVE-2021-36712 affectsyzmcms 6.1 with a Cross Site Scripting (XSS) flaw that can allow attackers to steal user cookies via the image clipping function. The entry shows a MEDIUM severity (CVSS v3.1: 5.4), attack vector NETWORK, low attack complexity, privilegeRequired LOW, userInteraction...

CVE-2021-36712

Cross Site Scripting XSS vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function...

CVE-2021-36712

Cross Site Scripting XSS vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function...

Yzmcms 跨站脚本漏洞

Yzmcms is an open source CMS Content Management System for Yzmcms individual developers. A cross-site scripting vulnerability exists in Yzmcms version 6.1. A remote attacker can exploit this vulnerability to steal user cookies via the image cutter function...

YzmCMS uncontrolled recursion vulnerability

Yzmcms is an open source CMS content management system for Yzmcms individual developers. an uncontrolled recursive vulnerability exists in YzmCMS v6.3, which stems from the fact that the comment function can operate concurrently and an attacker can use this vulnerability to create an unusually...

YzmCMS Cross-site Request Forgery Vulnerability (CNVD-2022-20583)

Yzmcms is an open source CMS Content Management System for Yzmcms individual developers. yzmCMS v6.3 has a cross-site request forgery vulnerability that allows attackers to arbitrarily delete user accounts via /admin/adminmanage/delete. No details of the vulnerability are currently available...

Yzmcms access control error vulnerability

Yzmcms is an open source CMS Content Management System for Yzmcms personal developers. v6.3 of Yzmcms contains an access control error vulnerability that stems from the application's lack of user login status authentication before accessing a personal homepage. An attacker could use this...

Yzmcms Cross-site Request Forgery Vulnerability (CNVD-2022-20584)

Yzmcms is an open source CMS Content Management System for Yzmcms personal developers. YzmCMS v6.3 is vulnerable to cross-site request forgery, which can be exploited by attackers to trigger cross-site request forgery CSRF via the component /yzmcms/comment/index/init.html...

CVE-2022-23383

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non...

Improper access control

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non...

Yzmcms 授权问题漏洞

Yzmcms is an open source CMS Content Management System for Yzmcms personal developers. v6.3 of Yzmcms contains an access control error vulnerability that stems from the application's lack of user login status authentication before accessing a personal homepage. An attacker could use this...

CVE-2022-23383

Affected software : YzmCMS v6.3. Vulnerability : broken access control allows unauthorized access to other users’ personal home pages without login. Root cause : the application fails to verify login status before accessing a personal homepage, enabling non-authenticated access to other users’ ho...