CVE-2019-9661

CVE-2019-9661 describes a stored cross-site scripting (XSS) vulnerability in the YzmCMS 5.2 content management system. The flaw is reachable through the admin/system_manage/user_config_edit.html page via the value parameter, allowing injection of script/HTML. The connected records confirm the vul...

CVE-2019-9660

CVE-2019-9660 is a stored XSS vulnerability in YzmCMS 5.2 exploitable via the admin/category/edit.html page using the catname parameter. Multiple sources (NVD/NVD CVE entry, CNVD, CVE lists) describe the issue; CVSSv3 base score 4.8 (medium) with network attack vector, low confidentiality/integri...

YzmCMS Cross-Site Scripting Vulnerability (CNVD-2019-07930)

YzmCMS is an open source CMS Content Management System by Yuan Zhimeng programmers in China. A cross-site scripting vulnerability exists in YzmCMS version 5.2. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML with the help of the 'configuration value'...

PT-2019-19785

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2 Description A stored XSS issue exists, allowing potential exploitation via the value parameter in the "admin/system manage/user config edit.html" API endpoint. Recommendations For YzmCMS version 5.2, consider restricting...

PT-2019-19784

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2 Description A stored XSS issue exists, allowing potential exploitation via the catname parameter in the admin/category/edit.html page. Recommendations For YzmCMS version 5.2, update the software to a version that includes a...

CVE-2019-9661: Improper Neutralization of Input During Web Page Generation

Stored XSS exists in YzmCMS 5.2 via the admin/systemmanage/userconfigedit.html "value" parameter,...

CVE-2019-9660: Improper Neutralization of Input During Web Page Generation

Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter...

CVE-2019-9570

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

Code injection

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

CVE-2019-9570

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

CVE-2019-9570

CVE-2019-9570 affects YzmCMS 5.2.0. The vulnerability is a reflected/persistent XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_code parameter. The description notes an XSS condition but does not provide details on the exact payload, affected configurat...

CVE-2019-9570

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

PT-2019-19716

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2.0 Description An issue was discovered that allows XSS via the bottom text field to the "admin/system manage/save.html" URI, related to the site code parameter. Recommendations For YzmCMS version 5.2.0, as a temporary...

CVE-2019-9570: Improper Neutralization of Input During Web Page Generation

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

Cross site request forgery (csrf)

YzmCMS v5.2 has admin/role/add.html CSRF...

CVE-2018-20015

YzmCMS v5.2 has admin/role/add.html CSRF...

CVE-2018-20015

YzmCMS 5.2 contains a CSRF vulnerability in admin/role/add.html. The CVE entry notes a CSRF weakness with a CVSSv3 base score of 8.8 (HIGH). Attack vector is NETWORK, with no privileges required, but user interaction is required, and impacts are HIGH for confidentiality, integrity, and availabili...

CVE-2018-20015

YzmCMS v5.2 has admin/role/add.html CSRF...

CVE-2018-20015: Cross-Site Request Forgery (CSRF)

YzmCMS v5.2 has admin/role/add.html CSRF...

PT-2018-15237

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2 Description The issue affects the admin/role/add.html endpoint, where a CSRF vulnerability is present. Recommendations For YzmCMS version 5.2, consider implementing CSRF protection measures, such as token-based validation, t...