Is there a public PoC exploit available for CVE-2026-13529?

Yes, a public proof-of-concept exploit is available for CVE-2026-13529. Prioritise patching immediately. EPSS: 0.2%.

YzmCMS CVE-2026-13529

Q: What is the CVSS score of CVE-2026-13529?

CVE-2026-13529 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40026 LOW

SQL Injection (CWE-89)

2026-06-29 VulDB

GHSA-p5fh-85g9-4mc9

PHP SQLi N A Yzmcms

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.6 MEDIUM

Network-reachable install endpoint requires no auth (PR:N) but high complexity per description; impact limited to partial CIA consistent with CVSS 4.0 VC:L/VI:L/VA:L with no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 04:22 NVD

6.3 (MEDIUM) 2.9 (LOW)

Analysis Generated

Jun 29, 2026 - 04:01 vuln.today

DescriptionCVE.org

A vulnerability was determined in YzmCMS up to 7.5. This affects an unknown function of the file /application/install/index.php. Executing a manipulation of the argument siteurl can lead to sql injection. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in YzmCMS up to version 7.5 allows network-based attackers to manipulate database queries by supplying crafted input to the siteurl argument within the installation endpoint /application/install/index.php. No authentication is required per the CVSS 4.0 vector (PR:N), though the attack is rated high complexity (AC:H), meaning exploitation is non-trivial despite a publicly available proof-of-concept on GitHub. The vendor did not respond to coordinated disclosure, leaving no official patch available; CVSS 4.0 scores this 6.3 with partial impact across confidentiality, integrity, and availability - no confirmed active exploitation (not in CISA KEV).

Technical ContextAI

YzmCMS is a PHP-based content management system. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in SQL Command) flaw residing in the installation controller at /application/install/index.php. The siteurl parameter, passed during setup configuration, is not sanitized before being interpolated into a SQL query, enabling injection of arbitrary SQL. The CPE cpe:2.3:a:n/a:yzmcms:*:*:*:*:*:*:*:* covers all versions up to 7.5 with no vendor identifier in the CPE authority field, indicating the product is not registered with a major vendor namespace in NVD. Installation endpoints are inherently sensitive as they interact directly with database bootstrapping logic, often running with elevated database privileges during setup. The application is PHP-driven, and the exploit was independently documented by a researcher via VulDB submission 840800.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor was contacted prior to disclosure and did not respond, leaving no official fix. The primary compensating control is to remove or block public access to /application/install/index.php immediately after completing installation: this can be accomplished via Nginx deny rules, Apache access controls, or file system removal of the install directory. This eliminates the attack surface entirely but disables reinstallation capability (acceptable in production). If source-level remediation is pursued by operators, apply parameterized queries or prepared statements to the siteurl parameter in /application/install/index.php to prevent SQL injection at the root cause. Monitor VulDB (https://vuldb.com/vuln/374537) and https://vuldb.com/submit/840800 for any future vendor patch release. Consider restricting network access to the install endpoint at the WAF or perimeter level as an additional defense layer.