CVE-2018-8756

YzmCMS v3.7.1 is affected by CVE-2018-8756 due to an eval injection in yzmphp/core/function/global.func.php. The vulnerability allows remote code execution via PHP code supplied in the POST data of the request index.php?m=member&c=member_content&a=init. The connected CNVD/CNVD-derived records cor...

CVE-2018-8756

Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...

PT-2018-18616

Name of the Vulnerable Software and Affected Versions YzmCMS version 3.7.1 Description The issue concerns an eval injection in a specific PHP file, allowing remote attackers to execute arbitrary code. This is achieved by sending PHP code in the POST data of a particular request to...

CVE-2018-8756: Improper Control of Generation of Code

Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...

CVE-2018-8078

YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...

Design/Logic Flaw

YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...

CVE-2018-8078

YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...

CVE-2018-8078

YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...

CVE-2018-8078

CVE-2018-8078 affects YzmCMS 3.7, where a Stored XSS vulnerability exists in the title parameter of advertisement/adver/edit.html. The root cause is unescaped user input in the title field, enabling arbitrary script/HTML injection. Documented impact is XSS with low to medium severity depending on...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2018-06397 )

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site scripting vulnerability exists in YzmCMS version 3.7. A remote attacker can exploit this vulnerability by sending the 'title' parameter to the advertisement/adver/edit.html page to...

PT-2018-18422

Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.7 Description: The issue is related to Stored XSS, which occurs via the title parameter to the "advertisement/adver/edit.html" endpoint. Recommendations: For YzmCMS version 3.7, update the software to a version that includes ...

CVE-2018-8078: Improper Neutralization of Input During Web Page Generation

YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...

Cross-Site Scripting Vulnerability in YZMCMS

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A cross-site scripting vulnerability exists in YzmCMS. Remote attackers can use this vulnerability to inject arbitrary Web script or...

YzmCMS Cross-Site Scripting Vulnerability

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site scripting vulnerability exists in YzmCMS. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML with the help of 'a', 'c' or 'm' parameters...

YzmCMS v3.6 Existing Override Vulnerability

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A vulnerability exists in YzmCMS v3.6. An attacker can exploit the vulnerability to access information beyond the authority...

CVE-2018-7653

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...

CVE-2018-7653

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...

Design/Logic Flaw

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...

CVE-2018-7653

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...

CVE-2018-7653

YzmCMS 3.6 is affected by a Cross-Site Scripting (XSS) in index.php via the a, c, or m parameters. The Nuclei template for CVE-2018-7653 confirms the vulnerability in YzmCMS 3.6, enabling arbitrary JavaScript execution in victims’ browsers, potentially leaking cookies or acting on behalf of authe...