Weng

**Name of the Vulnerable Software and Affected Versions** YzmCMS versions prior to 7.6 **Description** A remote cross-site scripting issue exists within the Header Handler component. The problem occurs in the `get url()` function located in the `/yzmphp/yzmphp.php` file, where improper handling of the `HTTP HOST` variable allows for the execution of malicious scripts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict or sanitize the `HTTP HOST` input used by the `get url()` function.