Overview 140 matches · 0 in Waratek scope · 0 protected · 4 exploited · 0 CISA KEV · 17 public PoC · 3 EPSS ≥ 0.5
140matches
0in Waratek scope0.0%
0protected0.0%
4exploited2.9%
0CISA KEV0.0%
17public PoC12.1%
3EPSS ≥ 0.52.1%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
140
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
140
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 31 / year
20072
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20084
Not applicable4
High4
not blocked4
Working exploit published4
20090
20100
20110
20120
20130
20141
Not applicable1
High1
not blocked1
Working exploit published1
20150
20160
20170
201829
Not applicable29
Critical3
High5
Medium21
not blocked29
Working exploit published1
Proof of concept only1
No public exploit27
20198
Not applicable8
Critical1
High1
Medium6
not blocked8
No public exploit8
20202
Not applicable2
Critical1
Medium1
not blocked2
Exploited1
No public exploit1
202113
Not applicable13
Critical1
High4
Medium8
not blocked13
No public exploit13
202231
Not applicable31
Critical25
High2
Medium4
not blocked31
Exploited3
Working exploit published5
Proof of concept only6
No public exploit17
202310
Not applicable10
Critical5
High3
Medium2
not blocked10
Proof of concept only2
No public exploit8
202420
Not applicable20
Critical4
High7
Medium8
Low1
not blocked20
Proof of concept only12
No public exploit8
202518
Not applicable18
Critical3
Medium15
not blocked18
Proof of concept only12
No public exploit6
20262
Not applicable2
Medium1
Low1
not blocked2
Proof of concept only2
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-29933 | Medium | 2026-03-26 | Not applicable | Proof of concept only | A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referrer value in the request header. |
| CVE-2026-1552 | Low | 2026-01-29 | Not applicable | Proof of concept only | A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMS_Info.php. The manipulation of the argument searchml leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2023-53975 | Critical | 2025-12-22 | Not applicable | No public exploit | Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks. |
| CVE-2025-60838 | Medium | 2025-10-10 | Not applicable | No public exploit | An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file. |
| CVE-2025-55797 | Medium | 2025-09-30 | Not applicable | No public exploit | An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed. |
| CVE-2025-56304 | Medium | 2025-09-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page. |
| CVE-2025-55835 | Critical | 2025-09-12 | Not applicable | Proof of concept only | File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering. |
| CVE-2025-56236 | Medium | 2025-08-28 | Not applicable | No public exploit | FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file, the script executes in their browser context. |
| CVE-2025-51660 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php. |
| CVE-2025-51659 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php. |
| CVE-2025-51658 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php. |
| CVE-2025-51657 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php. |
| CVE-2025-51656 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php. |
| CVE-2025-51655 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php. |
| CVE-2025-51654 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php. |
| CVE-2025-51653 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php. |
| CVE-2025-51652 | Medium | 2025-07-14 | Not applicable | Proof of concept only | SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php. |
| CVE-2025-3397 | Medium | 2025-04-08 | Not applicable | Proof of concept only | A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argument gourl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-25686 | Critical | 2025-03-27 | Not applicable | No public exploit | semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php. |
| CVE-2024-13193 | Medium | 2025-01-08 | Not applicable | Proof of concept only | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMS_Images.php of the component Image Library Management Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-53502 | Low | 2024-12-03 | Not applicable | No public exploit | Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page. |
| CVE-2024-52725 | Medium | 2024-11-20 | Not applicable | No public exploit | SemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to execute arbitrary code via the ldgid parameter in the SEMCMS_SeoAndTag.php component. |
| CVE-2024-46103 | Critical | 2024-09-20 | Not applicable | No public exploit | SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php. |
| CVE-2024-42991 | High | 2024-09-03 | Not applicable | Proof of concept only | MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution. |
| CVE-2024-39174 | Medium | 2024-07-05 | Not applicable | Proof of concept only | A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article. |
| CVE-2024-36801 | Medium | 2024-06-04 | Not applicable | No public exploit | A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the lgid parameter in Download.php. |
| CVE-2024-36800 | High | 2024-06-04 | Not applicable | Proof of concept only | A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php. |
| CVE-2024-35110 | Medium | 2024-05-17 | Not applicable | Proof of concept only | A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a malicious link, their cookies can be captured by an attacker. |
| CVE-2024-4595 | Medium | 2024-05-07 | Not applicable | Proof of concept only | A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is the function locate of the file function.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263317 was assigned to this vulnerability. |
| CVE-2024-28725 | High | 2024-05-06 | Not applicable | Proof of concept only | Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and System Settings. |
| CVE-2024-32409 | High | 2024-04-19 | Not applicable | No public exploit | An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script. |
| CVE-2024-30938 | Critical | 2024-04-19 | Not applicable | Proof of concept only | SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the ID parameter in the SEMCMS_User.php component. |
| CVE-2024-31012 | Critical | 2024-04-03 | Not applicable | Proof of concept only | An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the upload.php file. |
| CVE-2024-31010 | High | 2024-04-03 | Not applicable | Proof of concept only | SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php. |
| CVE-2024-31009 | Medium | 2024-04-03 | Not applicable | Proof of concept only | SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php. |
| CVE-2024-28405 | High | 2024-03-29 | Not applicable | Proof of concept only | SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page because authentication function is called from there, users gain admin privileges. |
| CVE-2024-25422 | Critical | 2024-02-28 | Not applicable | No public exploit | SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMS_Menu.php component. |
| CVE-2024-24291 | Medium | 2024-02-06 | Not applicable | No public exploit | An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL. |
| CVE-2023-52274 | Medium | 2024-01-11 | Not applicable | No public exploit | member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header. |
| CVE-2023-48864 | High | 2024-01-10 | Not applicable | Proof of concept only | SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php. |
| CVE-2023-50563 | Critical | 2023-12-14 | Not applicable | No public exploit | Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php. |
| CVE-2023-48863 | High | 2023-12-04 | Not applicable | No public exploit | SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engine for execution, and sends some attack codes as commands or query statements to the interpreter. These malicious data can deceive the interpreter, so as to execute unplanned commands or unauthorized access to data. |
| CVE-2020-23595 | High | 2023-08-11 | Not applicable | Proof of concept only | Cross Site Request Forgery (CSRF) vulnerability in yzmcms version 5.6, allows remote attackers to escalate privileges and gain sensitive information sitemodel/add.html endpoint. |
| CVE-2020-23564 | High | 2023-08-05 | Not applicable | Proof of concept only | File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php. |
| CVE-2023-37647 | Critical | 2023-07-31 | Not applicable | No public exploit | SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php. |
| CVE-2020-18432 | Critical | 2023-06-30 | Not applicable | No public exploit | File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges. |
| CVE-2020-20502 | Medium | 2023-06-20 | Not applicable | No public exploit | Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function. |
| CVE-2023-31707 | Critical | 2023-05-19 | Not applicable | No public exploit | SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php. |
| CVE-2023-30090 | Critical | 2023-05-05 | Not applicable | No public exploit | Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to execute arbitrary code via uploading a crafted PHP file. |
| CVE-2021-36712 | Medium | 2023-02-03 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function. |
| CVE-2021-38737 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php. |
| CVE-2021-38736 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php. |
| CVE-2021-38734 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php. |
| CVE-2021-38733 | Critical | 2022-10-28 | Not applicable | No public exploit | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php. |
| CVE-2021-38732 | Critical | 2022-10-28 | Not applicable | No public exploit | SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php. |
| CVE-2021-38731 | Critical | 2022-10-28 | Not applicable | No public exploit | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php. |
| CVE-2021-38730 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php. |
| CVE-2021-38729 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php. |
| CVE-2021-38728 | Medium | 2022-10-28 | Not applicable | No public exploit | SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php. |
| CVE-2021-38217 | Critical | 2022-10-28 | Not applicable | Proof of concept only | SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php. |
| CVE-2022-2726 | Critical | 2022-08-09 | Not applicable | No public exploit | A vulnerability classified as critical has been found in SEMCMS. This affects an unknown part of the file Ant_Check.php. The manipulation of the argument DID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205839. |
| CVE-2022-30048 | Critical | 2022-05-11 | Not applicable | No public exploit | Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter. |
| CVE-2022-30047 | Critical | 2022-05-11 | Not applicable | Exploited | Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter. |
| CVE-2022-27466 | Critical | 2022-05-02 | Not applicable | No public exploit | MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do. |
| CVE-2022-28036 | Critical | 2022-04-12 | Not applicable | No public exploit | AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_navigation.php |
| CVE-2022-28035 | Critical | 2022-04-12 | Not applicable | No public exploit | Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_blur-save.php |
| CVE-2022-28034 | Critical | 2022-04-12 | Not applicable | No public exploit | AtomCMS 2.0 is vulnerabie to SQL Injection via Atom.CMS_admin_ajax_list-sort.php |
| CVE-2022-28033 | Critical | 2022-04-12 | Not applicable | Working exploit published | Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_uploads.php |
| CVE-2022-28032 | Critical | 2022-04-12 | Not applicable | Working exploit published | AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_pages.php |
| CVE-2022-25489 | Medium | 2022-03-15 | Not applicable | Working exploit published | Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php. |
| CVE-2022-25488 | Critical | 2022-03-15 | Not applicable | Exploited | Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php. |
| CVE-2022-25487 | Critical | 2022-03-15 | Not applicable | Exploited | Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php. |
| CVE-2022-23383 | Critical | 2022-03-10 | Not applicable | No public exploit | YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non login status because real authentication is not carried out. |
| CVE-2022-25125 | Critical | 2022-03-03 | Not applicable | Working exploit published | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. |
| CVE-2022-23384 | High | 2022-02-15 | Not applicable | No public exploit | YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add |
| CVE-2022-24223 | Critical | 2022-02-01 | Not applicable | Working exploit published | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. |
| CVE-2022-23889 | Medium | 2022-01-28 | Not applicable | No public exploit | The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments. |
| CVE-2022-23888 | High | 2022-01-28 | Not applicable | No public exploit | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html. |
| CVE-2022-23887 | Medium | 2022-01-28 | Not applicable | No public exploit | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete. |
| CVE-2022-23314 | Critical | 2022-01-21 | Not applicable | No public exploit | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. |
| CVE-2022-22928 | Critical | 2022-01-21 | Not applicable | No public exploit | MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code. |
| CVE-2020-18081 | High | 2021-12-17 | Not applicable | No public exploit | The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext through a SQL query. |
| CVE-2020-18078 | Critical | 2021-12-17 | Not applicable | No public exploit | A vulnerability in /include/web_check.php of SEMCMS v3.8 allows attackers to reset the Administrator account's password. |
| CVE-2020-19951 | High | 2021-09-23 | Not applicable | No public exploit | A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the application. |
| CVE-2020-19950 | Medium | 2021-09-23 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML. |
| CVE-2020-19949 | Medium | 2021-09-23 | Not applicable | No public exploit | A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML. |
| CVE-2020-20341 | High | 2021-09-01 | Not applicable | No public exploit | YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function. |
| CVE-2020-19118 | Medium | 2021-07-30 | Not applicable | No public exploit | Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html. |
| CVE-2020-35972 | Medium | 2021-06-03 | Not applicable | No public exploit | An issue was discovered in YzmCMS V5.8. There is a CSRF vulnerability that can add member user accounts via member/member/add.html. |
| CVE-2020-35971 | Medium | 2021-06-03 | Not applicable | No public exploit | A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/system_manage/user_config_edit.html page. |
| CVE-2020-35970 | High | 2021-06-03 | Not applicable | No public exploit | An issue was discovered in YzmCMS 5.8. There is a SSRF vulnerability in the background collection management that allows arbitrary file read. |
| CVE-2020-23370 | Medium | 2021-05-10 | Not applicable | No public exploit | In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML. |
| CVE-2020-23369 | Medium | 2021-05-10 | Not applicable | No public exploit | In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3. |
| CVE-2020-18084 | Medium | 2021-04-30 | Not applicable | No public exploit | Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in. |
| CVE-2020-29597 | Critical | 2020-12-07 | Not applicable | Exploited | IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows unauthenticated attackers to upload files into the server. |
| CVE-2020-22394 | Medium | 2020-11-19 | Not applicable | No public exploit | In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. |
| CVE-2019-16532 | Medium | 2019-09-26 | Not applicable | No public exploit | An HTTP Host header injection vulnerability exists in YzmCMS V5.3. A malicious user can poison a web cache or trigger redirections. |
| CVE-2019-16678 | Medium | 2019-09-21 | Not applicable | No public exploit | admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. |
| CVE-2019-1010151 | Critical | 2019-07-19 | Not applicable | No public exploit | zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php. |
| CVE-2018-16247 | Medium | 2019-06-20 | Not applicable | No public exploit | YzmCMS 5.1 has XSS via the admin/system_manage/user_config_add.html title parameter. |