An issue was discovered in YxtCMF 3.1. SQL Injection exists in ShitiController.class.php via the ids array parameter to exam/shiti/delshiti.html.
CVSS Score
9.8
EPSS Score
0.003
Published
2018-03-06
An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/add_post.html.
CVSS Score
8.8
EPSS Score
0.001
Published
2018-03-06