CVE-2018-10223

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...

Cross site request forgery (csrf)

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...

CVE-2018-10224

CVE-2018-10224 describes a CSRF vulnerability in YzmCMS 3.8 that allows adding a tag via /index.php/admin/tag/add.html. The connected documents consistently reference this vulnerability in YzmCMS 3.8 and identify the attack surface as the admin tag-add endpoint. The CVE details do not provide exp...

CVE-2018-10223

CVE-2018-10223 affects YzmCMS 3.8. It is a Cross-Site Request Forgery (CSRF) vulnerability in /index.php/admin/admin_manage/add.html that can add an administrator account. Implication: attacker could obtain admin privileges on the affected system. Root cause: CSRF flaw enabling unauthorized admin...

CVE-2018-10224

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...

CVE-2018-10223

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...

YzmCMS Cross-Site Request Forgery Vulnerability

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site request forgery vulnerability exists in YzmCMS version 3.8. Remote attackers can use the /index.php/admin/tag/add.html page to add a Tag using this vulnerability...

YzmCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-08781)

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site request forgery vulnerability exists in YzmCMS version 3.8. A remote attacker can add an administrator account with the help of the /index.php/admin/adminmanage/add.html page to explo...

Design/Logic Flaw

The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php...

CVE-2018-10026

The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php...

CVE-2018-10026

The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php...

CVE-2018-10026

The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php...

CVE-2018-10026

The CVE describes a reflected cross-site scripting vulnerability in YzmCMS 3.7.1 within the WeChat module. The issue occurs when processing the admin/module/init.html echostr parameter, tied to the valid function in application/wechat/controller/index.class.php. This allows XSS via user-controlle...

YzmCMS 3.6 - Cross-Site Scripting

YzmCMS 3.6 - Cross-Site Scripting Exploit Title: YzmCMS 3.6 XSS Vulnerability Date: 2018-04-03 Exploit Author: zzw [email protected] Vendor Homepage: http://www.yzmcms.com/ Software Link: http://www.yzmcms.com/ Version: 3.6 CVE : CVE-2018-7653 This is a XSS vulnerability than can attack the users...

YzmCMS 3.6 - Cross-Site Scripting

Exploit Title: YzmCMS 3.6 XSS Vulnerability Date: 2018-04-03 Exploit Author: zzw [email protected] Vendor Homepage: http://www.yzmcms.com/ Software Link: http://www.yzmcms.com/ Version: 3.6 CVE : CVE-2018-7653 This is a XSS vulnerability than can attack the users. poc:...

YzmCMS 3.6 Cross Site Scripting

Exploit Title: YzmCMS 3.6 XSS Vulnerability Date: 2018-04-03 Exploit Author: zzw [email protected] Vendor Homepage: http://www.yzmcms.com/ Software Link: http://www.yzmcms.com/ Version: 3.6 CVE : CVE-2018-7653 This is a XSS vulnerability than can attack the users. poc:...

YzmCMS 3.6 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: YzmCMS 3.6 XSS Vulnerability Exploit Author: zzw email protected Vendor Homepage: http://www.yzmcms.com/ Software Link: http://www.yzmcms.com/ Version: 3.6 CVE : CVE-2018-7653 This is a XSS vulnerability than can attack the user...

YzmCMS Eval Injection Vulnerability

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A security vulnerability exists in the yzmphp/core/function/global.func.php file in YzmCMS version 3.7.1. A remote attacker can exploit this vulnerability by executing arbitrary code with the PHP...

CVE-2018-8756

Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...

CVE-2018-8756

Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...