CVE-2018-14583: Xyhcms

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

xyhai.php?s=/Auth/addUser in XYHCMS 3.5 allows CSRF to add a background administrator account.

Affected products

• Xyhcms Xyhcms: version 3.5 only

Published 2018-07-24. Last modified 2026-06-17.