A reflected cross‑site scripting vulnerability exists in the /index/login.html page of YZMCMS. By altering the Referrer header in a request to that page, an attacker can inject and execute arbitrary JavaScript within the victim’s browser session. This flaw permits client‑side code execution that could lead to data theft, credential compromise, or malicious network requests, classified as CWE‑79.

The issue affects the YZMCMS content management system, specifically version 7.4. The vulnerable code resides in the login page component, which is publicly accessible to all users with network connectivity to the application.

The nominal CVSS score is 6.1, indicating moderate severity, while the EPSS score is below 1 %, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker supply a manipulated Referrer header to a victim browser requesting the login page, a scenario that is attainable through phishing or malicious link contexts. Therefore, the risk is moderate with a relatively low likelihood of mass exploitation, but given the potential for credential theft or session hijacking, immediate remediation is advised.