| Title | YzmCMS V7.6 Cross Site Scripting |
|---|
| Description | During the security review of "YzmCMS V7.6", I discovered a reflected Cross-Site Scripting vulnerability in the `attachment/api/img_cropper` action (`/application/attachment/controller/api.class.php`). This vulnerability stems from insufficient user input validation of the 'cid' parameter, allowing attackers to inject malicious script tags into the response page. The crafted payload closes the enclosing inline `<script>` block via `</script>` and opens a new one, so the JavaScript executes as soon as the page is loaded by any logged-in user, without requiring interaction. Successful exploitation can lead to cookie theft, session hijacking, and performing privileged operations under the victim's identity. Immediate remedial measures are needed to ensure system security and protect data integrity.
|
|---|
| Source | ⚠️ https://github.com/Witiers/CVEs/issues/5 |
|---|
| User | Witiers (UID 99561) |
|---|
| Submission | 08/28/2026 09:51 (2 months ago) |
|---|
| Moderation | 10/10/2026 15:36 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 220194 [yzmcms 6.1 Image Clipping cross site scripting] |
|---|
| Points | 0 |
|---|