Eyoucms

CVE-2026-13569 Jun 29, 13:00 LOW POC Monitor

SQL injection in EyouCMS up to version 1.7.1 allows remote authenticated attackers with high privileges to manipulate database queries via the click_like argument in the /index.php API component. The CVSS 4.0 score is 2.0, heavily discounted by the PR:H requirement, yet confidentiality, integrity, and availability impacts are all rated Low. A public proof-of-concept exists via a GitHub issue report; the vendor has not acknowledged or patched the vulnerability. No active exploitation has been confirmed (not listed in CISA KEV).

CVE-2026-7388 Apr 29, 15:15 LOW POC Monitor

Code injection in EyouCMS versions 1.7.0 through 1.7.9 allows authenticated administrators to execute arbitrary PHP code via the Template File Handler's editFile function in FilemanagerLogic.php, enabling remote code execution on the underlying server. All versions across the entire 1.7.x branch are affected, and a proof-of-concept exploit is publicly available on Gitee. This vulnerability is not listed in CISA KEV; EPSS at 0.04% and SSVC automatable:no reflect the high-privilege prerequisite that limits mass exploitation, though the public POC lowers the bar for targeted insider or credential-compromise attacks.

CVE-2026-6561 Apr 19, 07:15 LOW POC Monitor

EyouCMS versions up to 1.7.1 allow high-privileged attackers to upload arbitrary files via manipulation of the filename parameter in the edit_adminlogo function, leading to information disclosure and potential code execution. The vulnerability requires authenticated admin access and is publicly exploitable with proof-of-concept code available on GitHub; the vendor has not responded to disclosure attempts.

CVE-2026-1107 Jan 18, 01:15 LOW POC Monitor

Unrestricted file upload in EyouCMS versions up to 1.7.1/5.0 allows authenticated remote attackers to upload arbitrary files through manipulation of the viewfile parameter in the Member Avatar Handler component. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. An authenticated attacker could leverage this to upload malicious files and potentially achieve remote code execution.

CVE-2025-15375 Dec 31, 05:16 LOW POC Monitor

PHP deserialization in EyouCMS up to version 1.7.7 allows authenticated remote attackers to pass a malicious serialized payload via the `attstr` argument to the `arcpagelist` handler in `application/api/controller/Ajax.php`, where the application calls PHP's `unserialize()` on unvalidated input. A public proof-of-concept exploit has been published and is available, lowering the barrier for opportunistic attackers. The vendor has acknowledged the flaw and committed to a fix in the upcoming v1.7.8 release; no confirmed active exploitation (KEV) has been recorded, and EPSS remains at 0.06%, indicating low observed in-the-wild activity at time of analysis.

CVE-2025-15374 Dec 31, 05:16 LOW POC Monitor

Cross-site scripting in EyouCMS up to version 1.7.7 allows a low-privileged remote attacker to inject malicious script content via the `content` argument in the Ask Module (`application/home/model/Ask.php`), which executes in the browser of any user who subsequently views the injected submission. A public proof-of-concept is available, though EPSS at 0.04% (11th percentile) and absence from CISA KEV indicate minimal observed exploitation despite the public PoC. The vendor has acknowledged the flaw and committed to releasing v1.7.8 as the fix, though that release has not been independently confirmed as available at time of analysis.

CVE-2025-15373 Dec 31, 04:15 LOW POC Monitor

Server-side request forgery (SSRF) in EyouCMS versions up to 1.7.7 allows authenticated remote attackers to manipulate the saveRemote function in application/function.php, enabling arbitrary HTTP requests from the server. The vulnerability carries low confidentiality, integrity, and availability impact but is publicly exploitable with proof-of-concept code available. Vendor has acknowledged the flaw and committed to releasing patched version 1.7.8.

CVE-2025-15143 Dec 28, 16:15 LOW POC Monitor

SQL injection in EyouCMS through version 1.7.6 allows authenticated administrators to manipulate the 'content' argument in the Backend Template Management component, potentially leading to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. The vendor has not responded to the disclosure.

CVE-2025-65868 Dec 03, 21:15 HIGH POC This Week

XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.

CVE-2025-52335 Aug 14, 18:15 MEDIUM This Month

EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-52680 Aug 07, 14:15 MEDIUM POC This Month

EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-11211 Nov 14, 15:15 MEDIUM This Month

A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-11210 Nov 14, 15:15 MEDIUM POC This Month

A vulnerability was found in EyouCMS 1.51. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-48196 Oct 28, 20:15 HIGH This Week

An issue in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-48195 Oct 28, 20:15 MEDIUM This Month

Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-3431 Apr 07, 22:15 HIGH This Week

A vulnerability was found in EyouCMS 1.6.5. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2024-23034 Feb 01, 23:15 MEDIUM POC This Month

Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-23033 Feb 01, 23:15 MEDIUM POC This Month

Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-23032 Feb 01, 23:15 MEDIUM POC This Month

Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-23031 Feb 01, 23:15 MEDIUM POC This Month

Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-22927 Feb 01, 23:15 MEDIUM POC This Month

Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-50566 Dec 14, 15:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-48882 Nov 29, 16:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Document Properties. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-48881 Nov 29, 16:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-48880 Nov 29, 16:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu Name field at. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-46935 Nov 21, 07:15 MEDIUM POC This Month

eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-41597 Nov 15, 06:15 MEDIUM POC This Month

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-37645 Jul 20, 22:15 MEDIUM POC THREAT This Month

eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-37136 Jul 06, 15:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-37135 Jul 06, 15:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-37134 Jul 06, 15:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-37133 Jul 06, 15:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-37132 Jul 06, 15:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-36093 Jun 22, 15:15 MEDIUM POC This Month

There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-34657 Jun 19, 04:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in Eyoucms v1.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the web_recordnum parameter. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33492 Jun 12, 13:15 MEDIUM POC This Month

EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-31708 May 23, 01:15 MEDIUM POC This Month

A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to the Upload software format function. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-30125 Apr 28, 14:15 MEDIUM POC This Month

EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-2058 Apr 14, 14:15 MEDIUM POC This Month

A vulnerability was found in EyouCms up to 1.6.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-2057 Apr 14, 14:15 MEDIUM POC This Month

A vulnerability was found in EyouCms 1.5.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-1799 Apr 02, 10:15 MEDIUM POC This Month

A vulnerability, which was classified as problematic, was found in EyouCMS up to 1.5.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-1798 Apr 02, 10:15 MEDIUM POC This Month

A vulnerability, which was classified as problematic, has been found in EyouCMS up to 1.5.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-45280 Nov 23, 21:15 MEDIUM POC This Month

A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-44390 Nov 14, 20:15 MEDIUM This Month

A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Record Number. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-44389 Nov 14, 20:15 MEDIUM This Month

EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-44387 Nov 14, 20:15 HIGH This Week

EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-43323 Nov 14, 20:15 HIGH POC This Week

EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Top Up Balance component under the Edit Member module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-41500 Oct 18, 23:15 HIGH POC This Week

EyouCMS V1.5.9 was discovered to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities via the Members Center, Editorial Membership, and Points Recharge components. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-36225 Aug 19, 17:15 HIGH POC This Week

EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-35509 Aug 10, 20:15 MEDIUM POC This Month

An issue was discovered in EyouCMS 1.5.8. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-33122 Jun 24, 21:15 MEDIUM POC This Month

A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL field under the login page. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-26273 Mar 28, 02:15 CRITICAL Act Now

EyouCMS v1.5.4 was discovered to lack parameter filtering in \user\controller\shop.php, leading to payment logic vulnerabilities. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-26279 Mar 24, 22:15 CRITICAL POC Act Now

EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-39501 Sep 07, 21:15 MEDIUM POC This Month

EyouCMS 1.5.4 is vulnerable to Open Redirect. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-39500 Sep 07, 21:15 HIGH This Week

Eyoucms 1.5.4 is vulnerable to Directory Traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-39499 Sep 07, 20:15 MEDIUM POC This Month

A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` parameter in bind_email function. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-39497 Sep 07, 20:15 CRITICAL POC Act Now

eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-39496 Sep 07, 20:15 MEDIUM POC This Month

Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-18129 Oct 22, 21:15 HIGH POC This Week

A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2019-17430 Oct 10, 12:10 MEDIUM PATCH This Month

EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.