Fiveaourtheo

Name of the Vulnerable Software and Affected Versions: YzmCMS version 5.3 Description: A cross-site scripting (XSS) issue in the "/link/add.html" component allows attackers to execute arbitrary web scripts or HTML. Recommendations: For YzmCMS version 5.3, update to a version that includes a fix for this issue, as no specific workaround is provided for this version.

Name of the Vulnerable Software and Affected Versions: YzmCMS version 5.3 Description: A cross-site scripting (XSS) issue in the "/banner/add.html" component allows attackers to execute arbitrary web scripts or HTML. This affects the ability to securely manage banners within the system. Recommendations: For YzmCMS version 5.3, consider disabling access to the "/banner/add.html" component until a patch is available to prevent exploitation of the XSS vulnerability. Restricting user input in this component can also help minimize the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: YzmCMS version 5.5 Description: A cross-site request forgery (CSRF) issue in the /controller/pay.class.php component allows attackers to access sensitive parts of the application. Recommendations: For YzmCMS version 5.5, consider implementing proper CSRF token validation to prevent unauthorized access to sensitive components. As a temporary workaround, restrict access to the /controller/pay.class.php endpoint until a patch is available.

An issue in SRCMS allows for a CSRF vulnerability, enabling the addition of an admin account via the "admin.php?m=Admin&c=manager&a=add" API endpoint.

A CSRF issue allows adding a user account via the "admin.php?m=Admin&c=member&a=add" API endpoint.

The issue allows for the addition of an admin account via the `admin.php?m=Member&a=adminadd` API endpoint, due to a CSRF vulnerability.