EUVD-2026-67328
GHSA-fwxc-gf6v-5f32
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Admin credentials required for exploitation (PR:H); admin panel network-accessible (AV:N); blind SQL injection enables full database read, write, and denial (C:H/I:H/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection, potentially leading to full database compromise.
AnalysisAI
SQL injection in YzmCMS 7.5 exposes the full database to authenticated administrators who supply a crafted parentid parameter to the category management interface. The flaw arises from unsanitized string concatenation inside a FIND_IN_SET() SQL clause within the get_arrchildid() function, enabling boolean-based blind injection that can enumerate and exfiltrate the entire database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid administrator-level credentials for the YzmCMS installation; the CVSS vector PR:H confirms this explicitly. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 7.2 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H accurately captures the risk profile: network-reachable but gated behind administrator authentication (PR:H), which substantially restricts the attacker pool. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update YzmCMS beyond version 7.5 to a release that addresses this vulnerability; however, a confirmed patched version number is not available in the current intelligence data - operators should monitor the YzmCMS GitHub repository at https://github.com/yzmcms/yzmcms for a fix release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all YzmCMS 7.5 instances and audit administrator access logs for unauthorized activity or suspicious category management queries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today