CVE-2020-18084: Yzmcms

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in.

Affected products

• Yzmcms Yzmcms: version 5.2 only

Published 2021-04-30. Last modified 2026-06-17.