A reflected cross‑site scripting (XSS) flaw exists in the /index/login.html component of YZMCMS v7.4. By altering the value of the Referrer header in a request, an attacker can inject arbitrary JavaScript that executes within the victim's browser. This allows the attacker to steal session cookies, deface content, or launch further phishing attacks, thereby compromising confidentiality and integrity of the user session.

The vulnerability affects YZMCMS version 7.4. No other versions or products are listed as impacted, and the vendor is not identified beyond the YZMCMS name.

The CVSS score is not provided, and EPSS information is unavailable, but the flaw is noted as not listed in the CISA KEV catalogue. As the Referrer header is a standard HTTP header, an attacker can add it through normal browser requests or crafted HTTP tools, making exploitation straightforward. The risk is moderate to high for any environment where users access the YZMCMS login page from untrusted networks.