CVE-2025-64048

6.1 mediumEPSS 0.2%

Medium (6.1) in yccms yccms. EPSS 0.2% chance of exploitation in the next 30 days.

YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-11-24
Modified: 2026-07-05
Record from: the NVD, synced 2026-10-19

Affected

yccms:yccms

References

https://gist.github.com/b1uel0n3/8354650e683ffb0812bfe72b702b482d

Check your stack JSON