VulnerabilityModified
CVE-2025-64048
YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality.
MEDIUM 6.1EPSS 0.18%
Does this matter?
Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.
Description
YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.18% probability · 8th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- yccms/yccms
- Source
- cve@mitre.org
References
- https://gist.github.com/b1uel0n3/8354650e683ffb0812bfe72b702b482dThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.