CVE-2026-75417
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A SQL injection vulnerability in YzmCMS 7.5 occurs in the get_arrchildid() function in category.class.php. The parentid parameter is directly concatenated into a FIND_IN_SET() SQL clause without proper sanitization, allowing an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection.
Risk Assessment
An attacking administrator can gain full access to the database, potentially leading to data theft, modification, or complete system compromise.
Recommendation
Immediately update YzmCMS to the latest version and use prepared statements or parameterized queries instead of directly concatenating user input into SQL queries.
Other vulnerabilities in YzmCMS
See all- CVE-2022-23383Critical
YzmCMS v6.3 is affected by a broken access control vulnerability that allows unauthorized access to users' personal home pages without login. The issue arises from missing authentication checks before accessing the home page, enabling attackers to view other users' pages while not logged in.
- CVE-2026-105156Low
A weakness has been identified in YzmCMS up to version 7.6 in the Password function of the file /common/function/system.func.php of the MD5 Handler component. Manipulating the pass argument can lead to a password hash with insufficient computational effort. The attack can be launched remotely but is characterized by high complexity and difficulty. The exploit has been made public and could be used for attacks.
- CVE-2026-15202Medium
A security vulnerability has been detected in YzmCMS up to version 7.5. The function get_url in the file /yzmphp/yzmphp.php of the Header Handler component is affected. Manipulation of the HTTP_HOST argument leads to cross-site scripting (XSS), which can be exploited remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-13529Medium
A SQL injection vulnerability was found in YzmCMS up to version 7.5 in the file /application/install/index.php. The attack involves manipulating the siteurl argument and can be executed remotely, though it is considered difficult to exploit. The exploit has been publicly disclosed.
- CVE-2025-56304Medium
Cross-site scripting (XSS) vulnerability in YzmCMS through version 7.3, located in the referer header on the registration page. It allows an attacker to inject malicious script into the victim's browser.
- CVE-2021-36712Medium
Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via the image clipping function.
Original NVD description (English source)
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection, potentially leading to full database compromise.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS