CVE-2023-36093
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
EyouCMS version 1.6.3 has a cross site scripting (XSS) vulnerability in the filing number on the backend management page under the Basic Information tab.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious code, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to update EyouCMS to the latest version to mitigate this vulnerability and review application security.
Other vulnerabilities in EyouCMS v1.6.3
See all- CVE-2026-116094High
A vulnerability was identified in EyouCMS up to version 1.8.3, affecting the remote_file_to_local function in application/function.php. Input manipulation can lead to server-side request forgery (SSRF). The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-13569Medium
A SQL injection vulnerability has been detected in EyouCMS up to version 1.7.1 in the /index.php file of the API component. An attacker can remotely manipulate the click_like argument, leading to SQL injection. The exploit has been publicly disclosed and may be used.
- CVE-2025-15143Medium
A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic/FilemanagerLogic.php of the component Backend Template Management. The manipulation of the argument content results in SQL injection. It is possible to launch the attack remotely, and the exploit has been released to the public.
- CVE-2025-52335Medium
EyouCMS 1.7.3 is vulnerable to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information.
- CVE-2024-52680Medium
EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. An attacker can inject malicious JavaScript code that executes in the victim's browser.
- CVE-2023-37136Medium
A stored cross-site scripting (XSS) vulnerability in the Basic Website Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2023-37135Medium
A stored cross-site scripting (XSS) vulnerability in the Image Upload module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2023-37134Medium
A stored cross-site scripting (XSS) vulnerability in the Basic Information module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2023-37133Medium
A stored cross-site scripting (XSS) vulnerability in the Column management module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2023-37132Medium
A stored cross-site scripting (XSS) vulnerability in the custom variables module of eyoucms v1.6.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Original NVD description (English source)
There is a storage type cross site scripting (XSS) vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3
Vulnerability data from NVD (NIST) · CISA KEV · EPSS