CVE-2018-10223

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.html.

• CWE-352

• http://www.8sec.cc/archives/596Exploit, Third Party Advisory
• https://github.com/yzmcms/yzmcms/issues/1Exploit, Third Party Advisory
• http://www.8sec.cc/archives/596Exploit, Third Party Advisory
• https://github.com/yzmcms/yzmcms/issues/1Exploit, Third Party Advisory

Published

Apr 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10213An issue was discovered in Vaultize Enterprise File Sharing …
• CVE-2018-10219baijiacms V3 has physical path leakage via an index.php?mod=…
• CVE-2018-1022A remote code execution vulnerability exists in the way the …
• CVE-2018-10220Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php …
• CVE-2018-10221An issue was discovered in WUZHI CMS V4.1.0. There is a pers…
• CVE-2018-10222An issue was discovered in idreamsoft iCMS V7.0. There is a …
• CVE-2018-10224An issue was discovered in YzmCMS 3.8. There is a CSRF vulne…
• CVE-2018-10225thinkphp 3.1.3 has SQL Injection via the index.php s paramet…
• CVE-2018-10227MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link pa…
• CVE-2018-10228Cross-site scripting (XSS) vulnerability in /application/con…6.1
• CVE-2018-10229A hardware vulnerability in GPU memory modules allows attack…
• CVE-2018-1023A remote code execution vulnerability exists in the way that…