https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-3743.htmlhttps://patchthecve.com/cve/CVE-2026-3743.htmlWed, 17 Jun 2026 10:44:07 +0000LOW 3.5: A flaw has been found in YiFang CMS 2.0.5. This affects the function update of the file app/db/admin/D_singlePageGroup.php. Executing a manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. Thhttps://patchthecve.com/cve/CVE-2026-3742.htmlhttps://patchthecve.com/cve/CVE-2026-3742.htmlWed, 17 Jun 2026 10:44:07 +0000LOW 3.5: A vulnerability was detected in YiFang CMS 2.0.5. The impacted element is the function update of the file app/db/admin/D_singlePage.php. Performing a manipulation of the argument Title results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may https://patchthecve.com/cve/CVE-2026-3741.htmlhttps://patchthecve.com/cve/CVE-2026-3741.htmlWed, 17 Jun 2026 10:44:07 +0000LOW 3.5: A security vulnerability has been detected in YiFang CMS 2.0.5. The affected element is the function update of the file app/db/admin/D_friendLink.php. Such manipulation of the argument linkName leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed pubhttps://patchthecve.com/cve/CVE-2026-2934.htmlhttps://patchthecve.com/cve/CVE-2026-2934.htmlWed, 17 Jun 2026 10:32:03 +0000LOW 2.4: A security vulnerability has been detected in YiFang CMS up to 2.0.5. This impacts the function update of the file app/db/admin/D_friendLinkGroup.php of the component Extended Management Module. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attachttps://patchthecve.com/cve/CVE-2026-2933.htmlhttps://patchthecve.com/cve/CVE-2026-2933.htmlWed, 17 Jun 2026 10:32:03 +0000LOW 2.4: A weakness has been identified in YiFang CMS up to 2.0.5. This affects the function update of the file app/db/admin/D_adManage.php of the component Extended Management Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. Thehttps://patchthecve.com/cve/CVE-2026-2932.htmlhttps://patchthecve.com/cve/CVE-2026-2932.htmlWed, 17 Jun 2026 10:32:03 +0000LOW 2.4: A security flaw has been discovered in YiFang CMS up to 2.0.5. The impacted element is the function update of the file app/db/admin/D_adPosition.php of the component Extended Management Module. Performing a manipulation of the argument name/index results in cross site scripting. The attack is possibhttps://patchthecve.com/cve/CVE-2025-11136.htmlhttps://patchthecve.com/cve/CVE-2025-11136.htmlFri, 09 Oct 2026 09:10:00 +0000MEDIUM 4.7: A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Backend. Executing manipulation of the argument uploadpath can lead to unrestricted upload. The attack can be launched remotely. The exploit has https://patchthecve.com/cve/CVE-2025-9400.htmlhttps://patchthecve.com/cve/CVE-2025-9400.htmlWed, 17 Jun 2026 10:08:53 +0000MEDIUM 6.3: A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be ushttps://patchthecve.com/cve/CVE-2025-9399.htmlhttps://patchthecve.com/cve/CVE-2025-9399.htmlWed, 17 Jun 2026 10:08:53 +0000MEDIUM 6.3: A vulnerability was detected in YiFang CMS up to 2.0.5. Affected by this issue is some unknown functionality of the file app/logic/L_tool.php. The manipulation of the argument new_url results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. The vendorhttps://patchthecve.com/cve/CVE-2025-9398.htmlhttps://patchthecve.com/cve/CVE-2025-9398.htmlWed, 17 Jun 2026 10:08:53 +0000MEDIUM 5.3: A security vulnerability has been detected in YiFang CMS up to 2.0.5. Affected by this vulnerability is the function exportInstallTable of the file app/utils/base/database/Migrate.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclohttps://patchthecve.com/cve/CVE-2025-5383.htmlhttps://patchthecve.com/cve/CVE-2025-5383.htmlWed, 17 Jun 2026 09:47:48 +0000LOW 2.4: A vulnerability was found in Yifang CMS up to 2.0.2 and classified as problematic. Affected by this issue is some unknown functionality of the component Article Management Module. The manipulation of the argument Default Value leads to cross site scripting. The attack may be launched remotely. The ehttps://patchthecve.com/cve/CVE-2025-5381.htmlhttps://patchthecve.com/cve/CVE-2025-5381.htmlWed, 17 Jun 2026 09:47:48 +0000LOW 2.7: A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/downloadFile of the component Admin Panel. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotelhttps://patchthecve.com/cve/CVE-2025-45887.htmlhttps://patchthecve.com/cve/CVE-2025-45887.htmlWed, 17 Jun 2026 09:25:49 +0000CRITICAL 9.1: Yifang CMS v2.0.2 is vulnerable to Server-Side Request Forgery (SSRF) in /api/file/getRemoteContent.