CVE-2024-35110

A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a malicious link, their cookies can be captured by an attacker.

CVSS v3.1

5.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

EPSS

0.29% chance of exploitation in the next 30 days, 22th percentile

Published

2024-05-17

Updated

2025-02-13

Proof-of-concept exploits (1)

• yzmcms/yzmcms/issues/68

References

• CVE Record
• NVD entry

Related

• CVE-2018-10223
• CVE-2018-10224
• CVE-2018-16247
• CVE-2018-17044
• CVE-2018-19092
• CVE-2019-16532