CVE-2018-7653: Improper Neutralization of Input During Web Page Generation

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...

PT-2018-18187

Name of the Vulnerable Software and Affected Versions YzmCMS version 3.6 Description The issue is related to an XSS vulnerability. It affects the index.php file through the a, c, or m parameters. Recommendations For YzmCMS version 3.6, consider restricting access to the vulnerable parameters a, c...

YzmCMS SQL Injection Vulnerability

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A SQL injection vulnerability exists in the \application\admin\controller\updateurls.class.php file in YzmCMS version 3.6. A remote attacker can exploit this vulnerability by sending a 'catids'...

CVE-2018-7579

\application\admin\controller\updateurls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/updateurls/updatecategoryurl.html...

Sql injection

\application\admin\controller\updateurls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/updateurls/updatecategoryurl.html...

CVE-2018-7579

\application\admin\controller\updateurls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/updateurls/updatecategoryurl.html...

CVE-2018-7579

\application\admin\controller\updateurls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/updateurls/updatecategoryurl.html...

CVE-2018-7579

CVE-2018-7579 affects YzmCMS 3.6; the vulnerable component is the file \application\admin\controller\update_urls.class.php, where the catids array parameter to admin/update_urls/update_category_url.html enables SQL Injection. The issue is described across multiple sources (NVD/CNVD/PRION/CVELIST)...

CVE-2018-7579: Improper Neutralization of Special Elements used in an SQL Command

\application\admin\controller\updateurls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/updateurls/updatecategoryurl.html...

PT-2018-18163

Name of the Vulnerable Software and Affected Versions YzmCMS version 3.6 Description The issue concerns SQL Injection in YzmCMS. Specifically, it occurs via the catids array parameter to the "admin/update urls/update category url.html" endpoint. Recommendations For YzmCMS version 3.6, consider...

CVE-2018-7479

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

Path traversal

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

CVE-2018-7479

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

CVE-2018-7479

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

CVE-2018-7479

YzmCMS 3.6 is affected by CVE-2018-7479, a path-disclosure/info-disclosure vulnerability. A remote attacker can discover the full server path by issuing a direct request to application/install/templates/s1.php. The issue is categorized as information disclosure with impact limited to confidential...

CVE-2018-7479: Exposure of Resource to Wrong Sphere

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

PT-2018-18094

Name of the Vulnerable Software and Affected Versions YzmCMS version 3.6 Description The issue allows remote attackers to discover the full path of the application via a direct request to "application/install/templates/s1.php". Recommendations For YzmCMS version 3.6, consider restricting access t...

YzmCMS Information Leakage Vulnerability

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. YzmCMS 3.6 suffers from an information disclosure vulnerability. A remote attacker can exploit this vulnerability by making a direct request to...

Code Execution Vulnerability in YzmCMS_v3.6

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A code execution vulnerability exists in YzmCMSv3.6. Allow attackers to exploit the vulnerability to execute script code and obtain...

YzmCMS_v3.6 Arbitrary File Deletion Vulnerability

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMSv3.6 has an arbitrary file deletion vulnerability. Attackers by cracking the background default account password , construct URL...