CVE-2026-29933 Details
Description
A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referrer value in the request header.
A reflected cross-site scripting vulnerability has been identified in YZMCMS version 7.4, specifically within the '/index/login.html' component. This vulnerability allows attackers to execute arbitrary JavaScript in the context of the user's browser by modifying the referrer value in the request header.
To address this vulnerability, implement input validation to verify the length, type, and syntax of incoming data. Apply output encoding to ensure that user-submitted data is properly encoded before being displayed. Specify the encoding method for output to prevent attackers from manipulating it. Avoid relying on blacklist verification methods, as they can be easily bypassed. Be cautious of normalization errors by decoding and normalizing input before validation, and filter out special characters from client-submitted data.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yzmcms/yzmcms/issues/69 | CISA-ADP | ExploitIssue TrackingMitigationVendor Advisory |
| https://github.com/yzmcms/yzmcms/issues/69 | [email protected] | ExploitIssue TrackingMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| yzmcms yzmcms | 7.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |