What is the CVSS score of CVE-2026-29933?

CVE-2026-29933 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Yzmcms CVE-2026-29933

EUVD-2026-16209 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 cve@mitre.org

GHSA-m982-7wj6-525g

XSS Yzmcms

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 15:22 euvd

EUVD-2026-16209

Analysis Generated

Mar 26, 2026 - 15:22 vuln.today

CVE Published

Mar 26, 2026 - 15:16 nvd

MEDIUM 6.1

DescriptionCVE.org

A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referrer value in the request header.

AnalysisAI

YZMCMS v7.4 suffers from a reflected cross-site scripting (XSS) vulnerability in the /index/login.html component that permits attackers to execute arbitrary JavaScript in a user's browser by manipulating the referrer value in request headers. Remote attackers can exploit this to steal session credentials, perform actions on behalf of authenticated users, or redirect users to malicious sites without requiring prior authentication. No public exploit code or active exploitation has been independently confirmed at the time of analysis.

Technical ContextAI

This vulnerability exploits improper input validation in the login page component of YZMCMS. The referrer HTTP header-which indicates the source of a request and is user-controllable in crafted requests-is reflected into the HTML response without sanitization or encoding. This falls under CWE-79 (Improper Neutralization of Input During Web Page Generation, or Cross-site Scripting). Unlike stored XSS, this reflected variant requires the attacker to socially engineer a victim into visiting a malicious link containing payload in the referrer parameter. The affected product is identified through the EUVD-2026-16209 identifier and references YZMCMS (a content management system) version 7.4 specifically.

RemediationAI

Upgrade YZMCMS to a patched version once released by the vendor; consult the GitHub issue at https://github.com/yzmcms/yzmcms/issues/69 for patch availability and timeline. As an immediate mitigation, implement output encoding on all user-supplied HTTP headers (including referrer) before reflecting them into HTML responses-specifically HTML-encode the referrer value and consider using a Content Security Policy (CSP) with script-src 'self' to restrict inline script execution. Web Application Firewall rules can be configured to detect XSS payloads in referrer headers. Until a vendor patch is confirmed, restrict administrative access to the login page via IP allowlisting or require a secondary authentication layer (e.g., multi-factor authentication) to reduce user credential compromise risk.