Cross Site Scripting Vulnerability in yzmcms by Linuka Deception
CVE-2021-36712

5.4MEDIUM

Key Information:

Vendor

Yzmcms

Status
Yzmcms
Vendor
CVE Published:
3 February 2023

What is CVE-2021-36712?

A Cross Site Scripting (XSS) vulnerability in yzmcms version 6.1 allows attackers to exploit the image clipping function, which can lead to unauthorized access to user cookies. This security flaw could enable attackers to impersonate users or steal sensitive information, thus compromising user accounts and data integrity. Organizations using this version of yzmcms should take immediate action to patch the vulnerability and safeguard their web applications.

References

http://yzmcms.com
https://github.com/linuka-deception/yzmcms6.1.git

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.