CVE-2018-10127

An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage=Rbac=addUser request, resulting in addition of an account with the administrator role...

CVE-2018-14583

xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account...

PT-2021-10510

Name of the Vulnerable Software and Affected Versions: XYHCMS version 3.6 Description: A cross-site request forgery issue exists in the "XYHCMS" software, specifically affecting the "/xyhai.php?s=/Auth/editUser" API endpoint. This allows attackers to modify administrator information, including...