An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HYoudiancms
APPYoudiancms≤ 9.5.20
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPE
CWE
Related vulnerabilities
CVE-2022-32301CRITICAL9.8ten sam produkt
YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib...
CVE-2022-32300HIGH8.8ten sam produkt
YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App...
CVE-2022-32299HIGH8.8ten sam produkt
YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Act...
CVE-2020-18116HIGH8.8ten sam produkt
A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL ...
CVE-2025-3531MEDIUM5.3ten sam produkt
A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of...