YCCMS
by YCCMS
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-20289 | Cri | 0.64 | 9.8 | 0.01 | Feb 1, 2021 | Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters, triggers a sql injection vulnerability. | ||
| CVE-2020-20287 | Cri | 0.64 | 9.8 | 0.03 | Feb 1, 2021 | Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code execution. | ||
| CVE-2020-20290 | Hig | 0.49 | 7.5 | 0.01 | Feb 1, 2021 | Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability. | ||
| CVE-2025-64048 | 0.00 | — | 0.00 | Nov 24, 2025 | YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title… |
- risk 0.64cvss 9.8epss 0.01
Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters, triggers a sql injection vulnerability.
- risk 0.64cvss 9.8epss 0.03
Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code execution.
- risk 0.49cvss 7.5epss 0.01
Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper judgment of the request parameters, triggers a directory traversal vulnerability.
- CVE-2025-64048Nov 24, 2025risk 0.00cvss —epss 0.00
YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title…