CVE-2018-11554: Yzmcms

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach.

Affected products

• Yzmcms Yzmcms: from 3.2, up to and including 3.7

Published 2018-06-05. Last modified 2026-06-17.