CVE-2026-2934

An attacker can exploit a vulnerability in YiFang CMS to inject malicious scripts into web pages, potentially allowing them to steal sensitive information from users who visit those pages. This can be done remotely by manipulating a specific input field, and the issue is already known and can be actively exploited.

This vulnerability allows an attacker to inject malicious scripts into a web page, which can then execute in the browsers of users visiting that page, potentially stealing their information or performing actions on their behalf. The attacker can exploit this remotely by manipulating a specific input field in the YiFang CMS software, and the issue is already public, meaning it could be exploited by anyone without needing special access.

An attacker can inject malicious scripts into a website using a vulnerability in YiFang CMS, allowing them to execute harmful code in the browsers of users who visit the affected site. This can be done remotely by manipulating a specific input field, and since the vendor has not responded to the issue, it remains a risk for users of the software.

An attacker can inject malicious scripts into the YiFang CMS, allowing them to execute harmful actions in the context of a user's browser. This vulnerability can be exploited remotely by manipulating a specific input field in the system's management module, and the exploit is publicly available.

An attacker can use this vulnerability to inject malicious scripts into a web page viewed by other users, potentially stealing their information or performing actions on their behalf. This can be done remotely by manipulating specific input fields in the YiFang CMS software, which is vulnerable in versions up to 2.0.5.