EUVD-2026-23837Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admin/L_rbac_admin.php of the component Extended Management Module. The manipulation of the argument Account results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored cross-site scripting (XSS) in Yifang CMS up to version 2.0.5 allows authenticated attackers to inject malicious scripts via the Account parameter in the Extended Management Module's RBAC admin component, affecting stored data integrity with user interaction required. The vulnerability has publicly available proof-of-concept code, though the CVSS score of 3.5 reflects its limited scope (no confidentiality or availability impact, information disclosure only). The vendor has not responded to early disclosure efforts.
Technical ContextAI
Yifang CMS is a PHP-based content management system. The vulnerability exists in the Extended Management Module at plugins/yifang_backend_account/logic/admin/L_rbac_admin.php, specifically in the store function which handles administrative account management. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating insufficient input validation or output encoding when processing the Account parameter. This allows attackers with authenticated access to inject unsanitized user input that will be reflected or stored in the application's web interface, executing arbitrary JavaScript in the context of other users' browsers when they interact with the affected functionality.
RemediationAI
Upgrade to a patched version greater than 2.0.5 if available from the vendor; however, no vendor-released patch has been identified at time of analysis, and the vendor has not responded to disclosure. As an immediate compensating control, restrict access to the Extended Management Module's admin functions by implementing network-level access controls-limit administrative access to the plugins/yifang_backend_account/ path to trusted IP addresses or VPN-only access to prevent unauthenticated users from gaining initial account access. Additionally, disable the Extended Management Module if it is not required for operations, removing the vulnerable component entirely. Apply output encoding or input validation at the application level if source code access permits; specifically, sanitize the Account parameter before storage and encode it during display using HTML entity encoding (e.g., htmlspecialchars() in PHP). Enable Web Application Firewall (WAF) rules to detect and block XSS payloads in POST/GET parameters targeting the vulnerable endpoint. These compensating controls reduce but do not eliminate risk; monitor the vendor for security updates and plan migration to an alternative CMS if Yifang CMS 2.0.5 remains unpatched.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today