YiFang vulnerabilities
We track 5 vulnerabilities in YiFang products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2025.
Latest YiFang vulnerabilities
- 7.2 High severity
CMS: Improper Access Control
A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Backend. Executing manipulation of the argument uploadpath can lead to unrestricted upload. The attack ca
- 8.8 High severity
CMS: Improper Access Control
A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The
- 8.8 High severity
CMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in YiFang CMS up to 2.0.5. Affected by this issue is some unknown functionality of the file app/logic/L_tool.php. The manipulation of the argument new_url results in sql injection. The attack may be launched remotely. The exploit i
- 7.5 High severity
CMS: Exposure of Sensitive Information to an Unauthorized Actor
A security vulnerability has been detected in YiFang CMS up to 2.0.5. Affected by this vulnerability is the function exportInstallTable of the file app/utils/base/database/Migrate.php. The manipulation leads to information disclosure. The attack may be initiat
- 7.2 High severity
CMS: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability, which was classified as problematic, was found in Yifang CMS up to 2.0.2. Affected is the function downloadFile of the file /api/File/downloadFile of the component Admin Panel. The manipulation of the argument File leads to path traversal. It