CVE-2020-20289

CRITICAL

yccms 3.3 - SQL Injection via no_top Function Request Parameter

Title source: llm

Description

Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters, triggers a sql injection vulnerability.

References (2)

Core 2

Core References

Product, Vendor Advisory, URL Repurposed x_refsource_misc

http://www.yccms.net/

Exploit, Third Party Advisory x_refsource_misc

https://blog.jiguang.xyz/posts/yccms-sql-injection/

Scores

CVSS v3 9.8

EPSS 0.0113

EPSS Percentile 62.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (1)

yccms/yccms 3.3

Published Feb 01, 2021

Tracked Since Feb 18, 2026