CVE-2020-23370: Yzmcms

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML.

Affected products

• Yzmcms Yzmcms: version 5.6 only

Published 2021-05-10. Last modified 2026-06-17.