The vulnerability is located in the get_url function of the Header Handler component in YzmCMS. A malicious value supplied in the HTTP_HOST request header is reflected directly into page content without proper encoding, creating a reflected cross‑site scripting (XSS) flaw identified as CWE‑79. When a victim loads a page containing the manipulated header, the injected script runs in the browser context, allowing an attacker to steal session cookies, deface webpages, or execute arbitrary client‑side actions. The flaw also involves code execution through the header (CWE‑94), as the unsanitized value can be processed by the server. Based on the description, it is inferred that attackers can trigger the issue remotely by sending a crafted HTTP_HOST header, either by directly making an HTTP request or by luring a user to a URL that forces the application to use a manipulated host header. The impact is a loss of confidentiality and integrity of the user session, potential defacement of site content, and a vector for phishing or credential theft.

YzmCMS versions up to and including 7.5 are affected. The vulnerability resides in the get_url function located in /yzmphp/yzmphp.php within the Header Handler component. All builds in the 7.x line remain vulnerable until the vendor releases a patch. No later versions are currently known to address the issue.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1 %, suggesting that exploitation of this weakness is considered unlikely by current threat models. The vulnerability is not listed in the CISA KEV catalog. Because the flaw can be triggered simply by manipulating a standard HTTP header, an attacker can deliver the payload without needing any privileged account or exploiting deeper vulnerabilities. The exploitation path is straightforward: send a request with a malicious HTTP_HOST value, which is then reflected by the application and executed in the victim’s browser. In the absence of a vendor fix, the threat remains present, but exploitation probability is low according to current EPSS data.