CVE-2026-75417

CVE-2026-75417 is a SQL injection flaw (CWE-89) in YzmCMS 7.5, located in the get_arrchildid() function of application/admin/controller/category.class.php. The user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without sanitization, enabling boolean-based blind SQL injection. An attacker with valid administrator credentials can execute arbitrary SQL queries against the backend database, potentially leading to full database compromise including data theft or tampering. Only YzmCMS deployments (version 7.5 is confirmed affected; the status of other versions is unverified) are exposed, and because exploitation requires administrator-level access, practical exposure is limited to sites where admin credentials are compromised or abused. No public proof-of-concept, in-the-wild exploitation, or KEV listing is known, and EPSS estimates only a 0.3% probability of exploitation within the next 30 days.

What to do: YzmCMS administrators should upgrade to the vendor's patched release as soon as one is available (the data confirms 7.5 as affected; check the vendor's changelog for the fixed version), or as an interim measure ensure the parentid parameter is cast to an integer or otherwise parameterized before being used in the FIND_IN_SET() clause. Because exploitation requires administrator credentials, rotate and harden admin passwords and review database and web logs for signs of blind injection probing. No public PoC or in-the-wild exploitation is currently known, so standard patch hygiene is sufficient for most deployments.