CVE-2026-6633 AKAOMA CVE VULNERABILITIES / 2h A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admin/L_rbac_admin.php of the component Extended Management Module. The manipulation of the argument Account results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this discl

Back cve.akaoma.com

CVE-2026-6633 AKAOMA CVE VULNERABILITIES / 2h A security flaw has been discovered in Yifang CMS up to 2.0.5. The impacted element is the function store of the file plugins/yifang_backend_account/logic/admin/L_rbac_admin.php of the component Extended Management Module. The manipulation of the argument Account results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this discl

cve.akaoma.com • April 20, 2026

Share: View original

3.5 /10 Moderate Risk Exploiting CVE-2026-6633 requires specific conditions, leading to a moderate security impact.

Exploiting CVE-2026-6633 requires specific conditions, leading to a moderate security impact.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-6633: XSS Vulnerability in Yifang CMS Exposes Users to Remote Attacks A cross-site scripting (XSS) vulnerability, identified as CVE-2026-6633, has been discovered in Yifang CMS versions up to 2.0.5. The flaw resides in the store function of the file plugins/yifang_backend_account/logic/admin/L_rbac_admin.php within the Extended Management Module. Attackers can exploit this vulnerability by manipulating the Account argument, allowing them to execute malicious scripts remotely. The vulnerability has a medium severity rating with a CVSS score of 5.1. Public exploit code is now available, increasing the risk of attacks, although no active exploitation has been confirmed in the wild. The vendor has not responded to disclosure attempts, and no official patch or remediation is currently available. Users are advised to implement web application firewall (WAF) rules and monitor for suspicious activity. Regular checks for updates from the vendor are recommended. 52

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

CWE-79 - Cross-site Scripting (xss)

Platforms (1)

Vulnerabilities (1)