Cross site scripting

Cross Site Scripting XSS vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function...

CVE-2021-36712

Summary: CVE-2021-36712 affectsyzmcms 6.1 with a Cross Site Scripting (XSS) flaw that can allow attackers to steal user cookies via the image clipping function. The entry shows a MEDIUM severity (CVSS v3.1: 5.4), attack vector NETWORK, low attack complexity, privilegeRequired LOW, userInteraction...

CVE-2021-36712

Cross Site Scripting XSS vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function...

CVE-2021-36712: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function...

CVE-2021-36712

Cross Site Scripting XSS vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function...

Yzmcms 跨站脚本漏洞

Yzmcms is an open source CMS Content Management System for Yzmcms individual developers. A cross-site scripting vulnerability exists in Yzmcms version 6.1. A remote attacker can exploit this vulnerability to steal user cookies via the image cutter function...

PT-2023-12298

Name of the Vulnerable Software and Affected Versions yzmcms version 6.1 Description The issue allows attackers to steal user cookies via the image clipping function, which is affected by a Cross Site Scripting XSS vulnerability. This can potentially lead to unauthorized access to user accounts...

Yzmcms access control error vulnerability

Yzmcms is an open source CMS Content Management System for Yzmcms personal developers. v6.3 of Yzmcms contains an access control error vulnerability that stems from the application's lack of user login status authentication before accessing a personal homepage. An attacker could use this...

YzmCMS uncontrolled recursion vulnerability

Yzmcms is an open source CMS content management system for Yzmcms individual developers. an uncontrolled recursive vulnerability exists in YzmCMS v6.3, which stems from the fact that the comment function can operate concurrently and an attacker can use this vulnerability to create an unusually...

Yzmcms Cross-site Request Forgery Vulnerability (CNVD-2022-20584)

Yzmcms is an open source CMS Content Management System for Yzmcms personal developers. YzmCMS v6.3 is vulnerable to cross-site request forgery, which can be exploited by attackers to trigger cross-site request forgery CSRF via the component /yzmcms/comment/index/init.html...

YzmCMS Cross-site Request Forgery Vulnerability (CNVD-2022-20583)

Yzmcms is an open source CMS Content Management System for Yzmcms individual developers. yzmCMS v6.3 has a cross-site request forgery vulnerability that allows attackers to arbitrarily delete user accounts via /admin/adminmanage/delete. No details of the vulnerability are currently available...

CVE-2022-23383

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non...

Improper access control

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non...

Yzmcms 授权问题漏洞

Yzmcms is an open source CMS Content Management System for Yzmcms personal developers. v6.3 of Yzmcms contains an access control error vulnerability that stems from the application's lack of user login status authentication before accessing a personal homepage. An attacker could use this...

CVE-2022-23383: Improper Authentication

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non...

CVE-2022-23383

Affected software : YzmCMS v6.3. Vulnerability : broken access control allows unauthorized access to other users’ personal home pages without login. Root cause : the application fails to verify login status before accessing a personal homepage, enabling non-authenticated access to other users’ ho...

CVE-2022-23383

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non...

CVE-2022-23383

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non...

PT-2022-15966

Name of the Vulnerable Software and Affected Versions YzmCMS version 6.3 Description The issue allows unauthorized access to a user's personal home page without requiring a login. Normally, the system should check the user's login status before granting access to the personal home page. However,...

YzmCMS Cross-site Request Forgery Vulnerability (CNVD-2022-12752)

YzmCMS is an open source CMS Content Management System.A cross-site request spoofing vulnerability exists in YzmCMS, which stems from insufficient validation in admin.add that the request is coming from a trusted user. An attacker could use this vulnerability to spoof malicious requests to trick...