CVE-2020-35970

In YzmCMS 5.8, a SSRF vulnerability exists in the backend collection management that allows arbitrary file read. Affected component: backend collection management module of YzmCMS 5.8. Root cause: server-side request forgery enabling access to arbitrary files. Impact stated as partial information...

CVE-2020-35970

An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read...

CVE-2020-35971

A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/systemmanage/userconfigedit.html page...

CVE-2020-35971

CVE-2020-35971 concerns a storage XSS in YzmCMS v5.8 affecting the page /admin/system_manage/user_config_edit.html . The vulnerability allows attackers to inject JavaScript/HTML, implying persistent script execution via stored payloads. The connected CNVD/CNNVD records describe a cross-site scrip...

CVE-2020-35972

An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html...

CVE-2020-35972

The CVE-2020-35972 entry relates to YzmCMS V5.8 and describes a Cross-Site Request Forgery (CSRF) vulnerability in the endpoint member/member/add.html. The weakness allows an attacker to cause the creation of new member user accounts via CSRF requests, as reported across multiple sources (CNVD/CN...

YzmCMS 代码问题漏洞

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. YzmCMS 5.8 version of the back-end collection management server-side request forgery vulnerability, an attacker can use the vulnerability to read any file...

YzmCMS 跨站脚本漏洞

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. YzmCMS 5.8 version of the /admin/systemmanage/userconfigedit.html page there is a cross-site scripting vulnerability, an attacker can use the vulnerability to inject...

YzmCMS YzmCMS 跨站请求伪造漏洞

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. YzmCMS 5.8 version of the existence of cross-site request forgery vulnerability, the attacker can be member/member/add.html through the use of this vulnerability to add...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2021-39769)

Yzmcms is an open source CMS Content Management System. A cross-site scripting vulnerability exists in YzmCMS version 5.6. The vulnerability stems from the program using UEditor 1.4.3.3, so the vulnerability can be exploited through the SRC attribute of the IFRAME element in...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2021-34497)

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. A stored cross-site scripting vulnerability exists in the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter in YzmCMS version 5.6. The vulnerabilit...

CVE-2020-23370

In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML...

CVE-2020-23369

In YzmCMS 5.6, XSS was discovered in member/membercontent/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3...

CVE-2020-23370

In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML...

CVE-2020-23369

In YzmCMS 5.6, XSS was discovered in member/membercontent/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3...

Input validation

In YzmCMS 5.6, XSS was discovered in member/membercontent/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3...

Cross site scripting

In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML...

CVE-2020-23369

In YzmCMS 5.6, XSS was discovered in member/membercontent/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3...

CVE-2020-23369

CVE-2020-23369 affects YzmCMS 5.6, where a cross-site scripting vulnerability exists in member/member_content/init.html due to using UEditor 1.4.3.3 . The underlying issue is an XSS via the SRC attribute of an IFRAME element, allowing injected scripts. Public records in NVD/CNVD/CNNVD confirm the...

CVE-2020-23370

In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML...