CVE-2022-23383

CriticalCVSS 9.1/10Last modified Jul 9, 2026

Description

YzmCMS v6.3 is affected by broken access control. Without login, unauthorized access to the user's personal home page can be realized. It is necessary to judge the user's login status before accessing the personal home page, but the vulnerability can access other users' home pages through the non login status because real authentication is not carried out.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://down.chinaz.com/soft/37810.htmProduct, Third Party Advisory
https://www.cnvd.org.cn/user/myreport/6499961Permissions Required, Third Party Advisory
https://down.chinaz.com/soft/37810.htmProduct, Third Party Advisory
https://www.cnvd.org.cn/user/myreport/6499961Permissions Required, Third Party Advisory

Timeline

Published: Mar 10, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-233848.8YzmCMS v6.3 is affected by Cross Site Request Forgery (CSRF) in /admin.add CVE-2022-233877.5An issue was discovered in taocms 3.0.2. This is a SQL blind injection that can obtain database data through the Comment Update field.CVE-2022-233899.8PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.CVE-2022-23397.5With this SSRF vulnerability, an attacker can reach internal addresses to make a request as the server and read it's contents. This attack c CVE-2022-233909.8An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files.CVE-2022-233916.1A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload ins CVE-2022-233956.1jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).CVE-2022-233976.1The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent CVE-2022-233999.8A stack-based buffer overflow vulnerability exists in the confsrv set_port_fwd_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14.CVE-2022-23404.8The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as adm CVE-2022-234007.1A stack-based buffer overflow vulnerability exists in the IGXMPXMLParser::parseDelimiter functionality of Accusoft ImageGear 19.10. A specia CVE-2022-234017.8The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP v