CVE-2026-75417CWE-89sql-injection

CVE-2026-75417

High · published August 28, 2026

CVSS v3.1

7.2

EPSS

Percentile

42.2

In the wild

Unconfirmed

What it is

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection, potentially leading to full database compromise.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00504 · 42.2th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-08-28T04:18Z

References (3)

https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75417 · [email protected]https://github.com/yzmcms/yzmcms · [email protected]https://github.com/TKar0/TKar0-CvePoc/blob/main/2026-CVE-POC/CVE-2026-75417/CVE-2026-75417.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

27 AUG 00:00Z
A SQL injection vulnerability was found in YzmCMS 7.5
cvelistv5