Vulnerabilities
5 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-21656 | XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index. XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index. NVD description · AI analysis pending | 5.4 | <1% | PoC |
| — | |
| CVE-2020-20586 | A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administ A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password. NVD description · AI analysis pending | 4.5 | <1% | PoC |
| — | |
| CVE-2018-14583 | xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account. xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account. NVD description · AI analysis pending | 8.8 | <1% | PoC |
| — | |
| CVE-2018-10127 +1 in the same advisory: …10128 | An issue was discovered in XYHCMS 3.5. An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrator role. NVD description · AI analysis pending | 8.8 group max | <1% |
| — |