MEDIUM🇵🇱 Wersja polska

CVE-2025-3531

CVSS 5.3v4.0pub. 2025-04-13upd. 2025-06-27

A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of the argument UserName/LogType leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Youdiancms

    APP
    Youdiancms
    9.5.21
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2024-57052CRITICAL9.8PL ✓same product

Eskalacja uprawnień przez manipulację sessionID w YouDianCMS

CVE-2022-32301CRITICAL9.8PL ✓same product

SQL injection w YoudianCMS v9.5.0 poprzez parametr IdList

CVE-2022-32300HIGH8.8same product

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App...

CVE-2022-32299HIGH8.8same product

YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Act...

CVE-2020-18116HIGH8.8same product

A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL ...