A flaw has been identified in YiFang CMS version 2.0.5, specifically within the update function of app/db/admin/D_singlePageGroup.php. The vulnerability arises from insufficient handling of the Name argument, allowing an attacker to inject arbitrary script code. This leads to cross‑site scripting (XSS), which can be triggered remotely by sending a crafted HTTP request. An exploit has already been published and is potentially usable against vulnerable installations.

The affected product is YiFang CMS version 2.0.5. The vulnerability is confined to the update function of the D_singlePageGroup.php file in the administrative module of this CMS. Only installations running the specific 2.0.5 release are impacted; no other versions or modules are mentioned in the advisory.

The CVSS score of 5.1 out of 10 places this issue in the moderate severity range. The vulnerability can be triggered remotely by sending a crafted HTTP request that embeds malicious data in the Name parameter of the update endpoint. The EPSS score of less than one percent indicates that exploitation is currently unlikely in large populations, though an exploit is already published. The vulnerability does not appear in the CISA KEV catalog. Based on the description, the likely attack vector is a remote HTTP request to the vulnerable update endpoint.