CVE-2021-39428: Eyoucms

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privilege via the filename for edit_users_head_pic.

Affected products

• Eyoucms Eyoucms: version 1.5.4 only

Published 2022-12-15. Last modified 2026-06-17.