415 matches found
CVE-2018-19849
An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter...
YzmCMS Cross-Site Scripting Vulnerability (CNVD-2018-26781)
YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site scripting vulnerability exists in YzmCMS version 5.2, which can be exploited by a remote attacker to inject arbitrary Web script or HTML by sending the 'searinfo' parameter to the...
CVE-2018-19092
An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie...
Design/Logic Flaw
An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie...
CVE-2018-19092
An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie...
CVE-2018-19092
CVE-2018-19092 affects YzmCMS v5.2, with an XSS vulnerability triggered through the search/index/archives/pubtime/ query string (e.g., …/pubtime/1526387722/page/1.html). The issue is described as an XSS that does not obtain a user’s cookie. The connected records confirm the vulnerability details ...
CVE-2018-17044
In YzmCMS 5.1, stored XSS exists via the admin/systemmanage/userconfigadd.html title parameter...
Cross site scripting
In YzmCMS 5.1, stored XSS exists via the admin/systemmanage/userconfigadd.html title parameter...
CVE-2018-17044
The CVE-2018-17044 entry affects YzmCMS 5.1 and is a stored cross-site scripting (XSS) vulnerability exposed through the admin/system_manage/user_config_add.html title parameter . The vulnerability allows injection of script into the title field, which can be stored and subsequently rendered to u...
CVE-2018-17044
In YzmCMS 5.1, stored XSS exists via the admin/systemmanage/userconfigadd.html title parameter...
YzmCMS User Traversal Vulnerability
YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A security vulnerability exists in the password retrieval function of the index.php/member/reset/resetemail.html page in YzmCMS version 3.2 to 3.7, which originates from the validity period of the...
CVE-2018-11554
The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...
CVE-2018-11554
The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...
CVE-2018-11554
Affected software: YzmCMS v3.2–v3.7 (index.php/member/reset/reset_email.html). Root cause / issue type: response discrepancy information exposure and an unexpectedly long lifetime for the verification code in the forgotten-password flow. Impact (as stated): easier for remote attackers to hijack a...
CVE-2018-11554
The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...
Stored Cross-Site Scripting Vulnerability in YzmCMS v3.8
YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A stored cross-site scripting vulnerability exists in YzmCMS v3.8. Attackers can insert malicious js code in the page to obtain user...
Cross site request forgery (csrf)
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...
CVE-2018-10223
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...