YzmCMS Cross-Site Scripting Vulnerability (CNVD-2019-07930)

YzmCMS is an open source CMS Content Management System by Yuan Zhimeng programmers in China. A cross-site scripting vulnerability exists in YzmCMS version 5.2. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML with the help of the 'configuration value'...

CVE-2019-9570

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

Code injection

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

CVE-2019-9570

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

CVE-2019-9570

CVE-2019-9570 affects YzmCMS 5.2.0. The vulnerability is a reflected/persistent XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. The description notes an XSS condition but does not provide details on the exact payload, affected configurat...

CVE-2019-9570

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

CVE-2018-20015

YzmCMS v5.2 has admin/role/add.html CSRF...

Cross site request forgery (csrf)

YzmCMS v5.2 has admin/role/add.html CSRF...

CVE-2018-20015

YzmCMS 5.2 contains a CSRF vulnerability in admin/role/add.html. The CVE entry notes a CSRF weakness with a CVSSv3 base score of 8.8 (HIGH). Attack vector is NETWORK, with no privileges required, but user interaction is required, and impacts are HIGH for confidentiality, integrity, and availabili...

CVE-2018-20015

YzmCMS v5.2 has admin/role/add.html CSRF...

CVE-2018-19849

An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter...

CVE-2018-19849

An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter...

Design/Logic Flaw

An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter...

CVE-2018-19849

CVE-2018-19849 concerns YzmCMS 5.2 where an XSS vulnerability exists in the admin/content/search.html page via the searinfo parameter. The issue arises from unsanitized input in that parameter, enabling script/HTML injection. Exploitation details are not provided in the connected documents; no pa...

CVE-2018-19849

An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2018-26781)

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site scripting vulnerability exists in YzmCMS version 5.2, which can be exploited by a remote attacker to inject arbitrary Web script or HTML by sending the 'searinfo' parameter to the...

CVE-2018-19092

An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie...

Design/Logic Flaw

An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie...

CVE-2018-19092

An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie...

CVE-2018-19092

CVE-2018-19092 affects YzmCMS v5.2, with an XSS vulnerability triggered through the search/index/archives/pubtime/ query string (e.g., …/pubtime/1526387722/page/1.html). The issue is described as an XSS that does not obtain a user’s cookie. The connected records confirm the vulnerability details ...