CVE-2026-120185

MediumCVSS 4.7

Published: 31/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 01/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

A security flaw was discovered in YznCMS up to version 2.2.0 in the Backend function of app/admin/controller/auth/Group.php (Auth Group Handler component). Manipulation results in improper privilege management. The attack can be initiated remotely, and upgrading to version 2.2.1 fixes the issue.

Risk Assessment

A remote attacker could exploit this flaw to escalate privileges or gain unauthorized access to administrative functions. This may lead to system compromise and data confidentiality breaches.

Recommendation

Immediately upgrade YznCMS to version 2.2.1 or apply patch ed16cd7f7f73e0316ffa8a148d. Until then, restrict access to the administrative panel.

Other vulnerabilities in YznCMS

CVE-2025-25791Medium
In YZNCMS v2.0.1, an arbitrary file upload vulnerability exists in the plugin installation feature. It allows an attacker to execute arbitrary code by uploading a crafted ZIP file.

Original NVD description (English source)

A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS