CVE-2021-42194

HIGH

EyouCMS 1.5.4-UTF8-SP3 - XXE via wechat_return XML Parsing

Title source: manual
STIX 2.1

Description

The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.

References (1)

Core 1
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/eyoucms/eyoucms/issues/19

Scores

CVSS v3 7.2
EPSS 0.0105
EPSS Percentile 59.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-611
Status published
Products (1)
eyoucms/eyoucms 1.5.4
Published Mar 20, 2022
Tracked Since Feb 18, 2026