CVE-2018-10026

Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.7.1

Description: The issue concerns a reflected XSS in the WeChat module of YzmCMS. This occurs via the echostr parameter in the admin/module/init.html endpoint, related to the valid function in the application/wechat/controller/index.class.php file.

Recommendations: For YzmCMS version 3.7.1, consider restricting access to the echostr parameter in the admin/module/init.html endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the echostr parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.