CVE-2025-3397 - YzmCMS message.tpl cross site scripting

Back Back to CVE browser

MEDIUM

YzmCMS message.tpl cross site scripting

Published Apr 8, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.54%

Description

A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argument gourl leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor n/a Product YzmCMS Default
n/a
- Version
  7.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

YzmCMS

n/a

Version	Status	Constraints
7.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (5)

https://vuldb.com/?ctiid.303642
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.303642
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.525203
third-party-advisoryThird Party AdvisoryVDB Entry
https://www.yuque.com/baimatangseng-iyusa/qwwm81/sqn7nf0irphq7f1k?singleDoc
exploitThird Party Advisory
https://www.yuque.com/baimatangseng-iyusa/qwwm81/sqn7nf0irphq7f1k?singleDoc#
exploitThird Party Advisory

Link	Providers	Tags
https://vuldb.com/?ctiid.303642		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.303642		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.525203		third-party-advisoryThird Party AdvisoryVDB Entry
https://www.yuque.com/baimatangseng-iyusa/qwwm81/sqn7nf0irphq7f1k?singleDoc		exploitThird Party Advisory
https://www.yuque.com/baimatangseng-iyusa/qwwm81/sqn7nf0irphq7f1k?singleDoc#		exploitThird Party Advisory