Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admin/L_rbac_admin.php of the component Extended Management Module. The manipulation of the argument Account results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
BREAKING: CVE-2026-6633 XSS bug in Yifang CMS up to 2.0.5 now has public exploit code, vendor silent and no patch available. https://threatcluster.io/cluster/cve-2026-6633-xss-vulnerability-in-yifang-cms-exposes-users--9beb3395
Post summary
CVE-2026-6633 is an XSS flaw in Yifang CMS (up to 2.0.5) with an openly available exploit; the vendor has not released a patch.
CVE-2026-6633 Cross Site Scripting in Yifang CMS Up To 2.0.5 Extended Management Module https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6633
Post summary
The text merely announces CVE-2026-6633 with a brief description and a link, providing no additional detail.
CVE-2026-6633 A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admin/L_rbac_… https://www.cve.org/CVERecord?id=CVE-2026-6633
Post summary
A new vulnerability (CVE-2026-6633) has been discovered in Yifang CMS up to version 2.0.5, affecting the function store within a specific plugin file, but no proof of concept, exploit, or patch information is provided.