PT-2026-53199 · Yzmcms · Yzmcms

D.Rose · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-13529

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions YzmCMS versions prior to 7.6

Description A remote SQL injection issue exists in the /application/install/index.php file. The flaw allows for the manipulation of the siteurl argument, which can lead to unauthorized database queries. This attack is characterized by high complexity and is reported as difficult to exploit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-13529

Affected Products

Yzmcms

References · 7

• 🔥 https://github.com/drose025/security/blob/main/1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-13529 · Security Note
• https://twitter.com/VulmonFeeds/status/2071466861292650511 · Twitter Post
• https://vuldb.com/vuln/374537 · Note
• https://vuldb.com/vuln/374537/cti · Note
• https://vuldb.com/cve/CVE-2026-13529 · Note
• https://vuldb.com/submit/840800 · Note