CVE-2018-11554

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-05 · updated 2026-06-17
Weakness: CWE-200

Description

The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force approach.

Affected products

YzmCMS: from 3.2 through 3.7

References

https://github.com/littleheary/-YzmCMS-User-Traversal-Vulnerability/blob/master/README.md
https://github.com/littleheary/-YzmCMS-User-Traversal-Vulnerability/blob/master/README.md

Get alerted when CVE-2018-11554 or the next vulnerability affects your stack