yfcmf vulnerabilities

Products

• yfcmf 3

Latest yfcmf CVEs

Newest publication first

1. CVE-2020-23691 YFCMF v2.3.1 has a Remote Command Execution (RCE) vulnerability in the index.php.

   Published 2021-05-14

   Critical·CVSS 9.8 EPSS 3.4%

   YFCMF v2.3.1 has a Remote Command Execution (RCE) vulnerability in the index.php.

2. CVE-2020-23689 In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.

   Published 2021-05-14

   Medium·CVSS 4.8 EPSS 0.59%

   In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.

3. CVE-2018-16431 admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account.

   Published 2018-09-04

   High·CVSS 8.8 EPSS 0.85%

   admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.