CVE-2024-52680
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Risk Assessment
The risk includes potential theft of admin session cookies, takeover of the management panel, and unauthorized operations within the CMS.
Recommendation
Immediately update EyouCMS to the latest version and apply input filtering on URL parameters. Additionally, implement Content-Security-Policy headers.
Other vulnerabilities in EyouCMS
See all- CVE-2026-13569Medium
A SQL injection vulnerability has been detected in EyouCMS up to version 1.7.1 in the /index.php file of the API component. An attacker can remotely manipulate the click_like argument, leading to SQL injection. The exploit has been publicly disclosed and may be used.
- CVE-2025-52335Medium
EyouCMS 1.7.3 is vulnerable to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information.
- CVE-2023-37136Medium
A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2023-37135Medium
A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2023-37134Medium
A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2023-37133Medium
A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2023-37132Medium
A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2023-36093Medium
EyouCMS version 1.6.3 has a cross site scripting (XSS) vulnerability in the filing number on the backend management page under the Basic Information tab.
- CVE-2023-34657Medium
Eyoucms v1.6.2 has a stored cross-site scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the web_recordnum parameter.
- CVE-2023-33492Medium
EyouCMS version 1.6.2 is vulnerable to Cross Site Scripting (XSS) attacks, which may allow attackers to inject malicious code into the application.
Original NVD description (English source)
EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS