415 matches found
Sql injection
Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...
CVE-2018-8756
Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...
CVE-2018-8756
Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...
CVE-2018-8756
YzmCMS v3.7.1 is affected by CVE-2018-8756 due to an eval injection in yzmphp/core/function/global.func.php. The vulnerability allows remote code execution via PHP code supplied in the POST data of the request index.php?m=member&c=member_content&a=init. The connected CNVD/CNVD-derived records cor...
Design/Logic Flaw
YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...
CVE-2018-8078
YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...
CVE-2018-8078
YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...
CVE-2018-8078
CVE-2018-8078 affects YzmCMS 3.7, where a Stored XSS vulnerability exists in the title parameter of advertisement/adver/edit.html. The root cause is unescaped user input in the title field, enabling arbitrary script/HTML injection. Documented impact is XSS with low to medium severity depending on...
CVE-2018-8078
YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...
YzmCMS Cross-Site Scripting Vulnerability (CNVD-2018-06397 )
YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site scripting vulnerability exists in YzmCMS version 3.7. A remote attacker can exploit this vulnerability by sending the 'title' parameter to the advertisement/adver/edit.html page to...
Cross-Site Scripting Vulnerability in YZMCMS
YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A cross-site scripting vulnerability exists in YzmCMS. Remote attackers can use this vulnerability to inject arbitrary Web script or...
YzmCMS Cross-Site Scripting Vulnerability
YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site scripting vulnerability exists in YzmCMS. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML with the help of 'a', 'c' or 'm' parameters...
YzmCMS v3.6 Existing Override Vulnerability
YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A vulnerability exists in YzmCMS v3.6. An attacker can exploit the vulnerability to access information beyond the authority...
CVE-2018-7653
In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...
Design/Logic Flaw
In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...
CVE-2018-7653
In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...
CVE-2018-7653
In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...
CVE-2018-7653
YzmCMS 3.6 is affected by a Cross-Site Scripting (XSS) in index.php via the a, c, or m parameters. The Nuclei template for CVE-2018-7653 confirms the vulnerability in YzmCMS 3.6, enabling arbitrary JavaScript execution in victims’ browsers, potentially leaking cookies or acting on behalf of authe...
YzmCMS SQL Injection Vulnerability
YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A SQL injection vulnerability exists in the \application\admin\controller\updateurls.class.php file in YzmCMS version 3.6. A remote attacker can exploit this vulnerability by sending a 'catids'...