Youdiancms develops a content management system that, despite a narrow product portfolio, ranks among more prominent vendors in the vulnerability landscape. Vulnerabilities affecting the product skew toward serious outcomes, with an elevated share reaching critical severity, and concentrate consistently around web-application input handling and file-management weaknesses including SQL injection, code injection, cross-site scripting, unrestricted file uploads, and information disclosure. Defenders should treat updates to this CMS as a priority where it is deployed and restrict upload functionality; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Youdiancms over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-32301CRITICAL YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php. | Jun 15, 2022 | 9.8 | 31 | NO | NO |
CVE-2024-57052CRITICAL An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file. | Jan 27, 2025 | 9.8 | 29 | NO | NO |
CVE-2024-7329CRITICAL A vulnerability, which was classified as critical, was found in YouDianCMS 7. Affected is an unknown function of the file /Public/ckeditor/plugins/multiimage/dialogs/image_upload.p | Jul 31, 2024 | 9.8 | 27 | NO | NO |
CVE-2022-32300HIGH YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php. | Jun 15, 2022 | 8.8 | 27 | NO | NO |
CVE-2022-32299HIGH YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Action/Admin/SiteAction.class.php. | Jun 15, 2022 | 8.8 | 22 | NO | NO |
CVE-2020-18116HIGH A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection. | Aug 27, 2021 | 8.8 | 22 | NO | NO |
CVE-2025-3533MEDIUM A vulnerability, which was classified as problematic, has been found in YouDianCMS 9.5.21. This issue affects some unknown processing of the file /App/Tpl/Admin/Default/Channel/ind | Apr 13, 2025 | 6.1 | 20 | NO | NO |
CVE-2025-3532MEDIUM A vulnerability classified as problematic was found in YouDianCMS 9.5.21. This vulnerability affects unknown code of the file /App/Tpl/Member/Default/Order/index.html.Attackers. Th | Apr 13, 2025 | 6.1 | 20 | NO | NO |
CVE-2025-3531MEDIUM A vulnerability classified as problematic has been found in YouDianCMS 9.5.21. This affects an unknown part of the file /App/Tpl/Admin/Default/Log/index.html. The manipulation of t | Apr 13, 2025 | 6.1 | 20 | NO | NO |
CVE-2024-7330MEDIUM A vulnerability has been found in YouDianCMS 7 and classified as critical. Affected by this vulnerability is the function curl_exec of the file /App/Core/Extend/Function/ydLib.php. | Aug 1, 2024 | 6.3 | 18 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Youdiancms.
Media articles that mention a CVE ID that affects a product developed by Youdiancms — matched by CVE ID, not by vendor name.