A remote cross‑site scripting flaw exists in YiFang CMS through the update function of app/db/admin/D_adPosition.php. By manipulating the name or index arguments during a position update, an attacker can inject arbitrary script code that will execute in the browser context of users who view the affected content, potentially leading to session hijacking, data theft, or defacement of the site. The vulnerability is present in all releases up to version 2.0.5. The publish of public exploit code indicates that an attacker can attempt to weaponize the flaw readily.

The vulnerability affects the YiFang CMS product, specifically any installation using the Extended Management Module up to and including version 2.0.5. No other vendors or product lines are listed as impacted.

The CVSS score of 4.8 classifies the flaw as medium severity, and the EPSS probability is less than 1 %, indicating that while exploitation is technically possible, it is unlikely to be widely used at present. The flaw is not listed in CISA’s KEV catalog, which further suggests limited exploitation activity. Precisely because the attack vector is remote and triggered via HTTP parameters, an attacker only needs network access to the management interface to successfully inject malicious code. Once executed, the impact could affect confidentiality, integrity, and availability for the affected user base.