CVE-2026-105156
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A weakness has been identified in YzmCMS up to version 7.6 in the Password function of the file /common/function/system.func.php of the MD5 Handler component. Manipulating the pass argument can lead to a password hash with insufficient computational effort. The attack can be launched remotely but is characterized by high complexity and difficulty. The exploit has been made public and could be used for attacks.
Risk Assessment
Due to weak password hashing, an attacker can more easily crack user passwords, potentially leading to unauthorized access to accounts and data.
Recommendation
Follow the vendor's guidance: before the new version (scheduled for March 2027) is available, implement the published security mitigation measures, and apply the update as soon as it is released.
Other vulnerabilities in YzmCMS
See all- CVE-2022-23383Critical
YzmCMS v6.3 is affected by a broken access control vulnerability that allows unauthorized access to users' personal home pages without login. The issue arises from missing authentication checks before accessing the home page, enabling attackers to view other users' pages while not logged in.
- CVE-2026-75417High
A SQL injection vulnerability in YzmCMS 7.5 occurs in the get_arrchildid() function in category.class.php. The parentid parameter is directly concatenated into a FIND_IN_SET() SQL clause without proper sanitization, allowing an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection.
- CVE-2026-15202Medium
A security vulnerability has been detected in YzmCMS up to version 7.5. The function get_url in the file /yzmphp/yzmphp.php of the Header Handler component is affected. Manipulation of the HTTP_HOST argument leads to cross-site scripting (XSS), which can be exploited remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-13529Medium
A SQL injection vulnerability was found in YzmCMS up to version 7.5 in the file /application/install/index.php. The attack involves manipulating the siteurl argument and can be executed remotely, though it is considered difficult to exploit. The exploit has been publicly disclosed.
- CVE-2025-56304Medium
Cross-site scripting (XSS) vulnerability in YzmCMS through version 7.3, located in the referer header on the registration page. It allows an attacker to inject malicious script into the victim's browser.
- CVE-2021-36712Medium
Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via the image clipping function.
Original NVD description (English source)
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The vendor kindly explains: "Our regular release cycle is about 6 months. The last release was in the previous month, and our next scheduled version will be released in March 2027. We will implement the backward-compatible gradual hash migration feature in this upcoming release. (...) Before the new version is available, we will publish security mitigation guidance on our official documentation for existing deployers to reduce the risk."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS