CVE-2026-15202

Name of the Vulnerable Software and Affected Versions YzmCMS versions prior to 7.6

Description A remote cross-site scripting issue exists within the Header Handler component. The problem occurs in the get url() function located in the /yzmphp/yzmphp.php file, where improper handling of the HTTP HOST variable allows for the execution of malicious scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict or sanitize the HTTP HOST input used by the get url() function.