A weakness in YzmCMS up to version 7.6 allows for a password hash with insufficient computational effort due to improper use of MD5 in the Password function of /common/function/system.func.php. This issue, characterized by high complexity and difficult exploitability, can be exploited remotely. The vendor plans to release a backward-compatible gradual hash migration feature in the next scheduled version i [truncated]
The CVE-2026-75417 vulnerability is a SQL injection issue in YzmCMS 7.5, occurring in the get_arrchildid() function within application/admin/controller/category.class.php. The user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization, allowing authenticated administrators to execute arbitrary SQL queries via boolean-based blind injection, poten [truncated]
