MEDIUM🇬🇧 English

CVE-2025-3531

CVSS 5.3v4.0pub. 2025-04-13upd. 2025-06-27

A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Youdiancms

    APP
    Youdiancms
    9.5.21
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
XSS
CWE
Referencje

Powiązane podatności

CVE-2024-57052CRITICAL9.8PL ✓ten sam produkt

Eskalacja uprawnień przez manipulację sessionID w YouDianCMS

CVE-2022-32301CRITICAL9.8ten sam produkt

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib...

CVE-2022-32300HIGH8.8ten sam produkt

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App...

CVE-2022-32299HIGH8.8ten sam produkt

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Act...

CVE-2020-18116HIGH8.8ten sam produkt

A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL ...

CVE-2025-3531 — MEDIUM 5.3 | CVEbaza.pl