Sql injection

\application\admin\controller\updateurls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/updateurls/updatecategoryurl.html...

CVE-2018-7579

\application\admin\controller\updateurls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/updateurls/updatecategoryurl.html...

CVE-2018-7579

\application\admin\controller\updateurls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to admin/updateurls/updatecategoryurl.html...

CVE-2018-7579

CVE-2018-7579 affects YzmCMS 3.6; the vulnerable component is the file \application\admin\controller\update_urls.class.php, where the catids array parameter to admin/update_urls/update_category_url.html enables SQL Injection. The issue is described across multiple sources (NVD/CNVD/PRION/CVELIST)...

Path traversal

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

CVE-2018-7479

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

CVE-2018-7479

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

CVE-2018-7479

YzmCMS 3.6 is affected by CVE-2018-7479, a path-disclosure/info-disclosure vulnerability. A remote attacker can discover the full server path by issuing a direct request to application/install/templates/s1.php. The issue is categorized as information disclosure with impact limited to confidential...

CVE-2018-7479

YzmCMS 3.6 allows remote attackers to discover the full path via a direct request to application/install/templates/s1.php...

YzmCMS Information Leakage Vulnerability

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture developed by Yuan Zhimeng alone. YzmCMS 3.6 suffers from an information disclosure vulnerability. A remote attacker can exploit this vulnerability by making a direct request to...

Code Execution Vulnerability in YzmCMS_v3.6

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A code execution vulnerability exists in YzmCMSv3.6. Allow attackers to exploit the vulnerability to execute script code and obtain...

YzmCMS_v3.6 Arbitrary File Deletion Vulnerability

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMSv3.6 has an arbitrary file deletion vulnerability. Attackers by cracking the background default account password , construct URL...

Cross-site scripting vulnerability in Yzmcms frontend

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. Yzmcms frontend has cross-site scripting vulnerabilities. Attackers can insert malicious js code in the page to obtain user cookies an...

SQL Injection Vulnerability in YzmCMS /member/account.php Page

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMS /member/account.php page has a SQL injection vulnerability. Because the /member/account.php page does not filter parameters, an...

SQL Injection Vulnerability in YzmCMS email.php

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A SQL injection vulnerability exists in YzmCMS email.php. An attacker can exploit the vulnerability to obtain sensitive information...