CVE-2018-8756

Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=member_content&a=init request.

• CWE-94

• https://github.com/guiciwushuang/yzmcms/blob/master/yzmcms_eval_injection_chinese.pdfThird Party Advisory
• https://github.com/guiciwushuang/yzmcms/blob/master/yzmcms_eval_injection_english.pdfExploit, Third Party Advisory
• https://github.com/guiciwushuang/yzmcms/blob/master/yzmcms_eval_injection_chinese.pdfThird Party Advisory
• https://github.com/guiciwushuang/yzmcms/blob/master/yzmcms_eval_injection_english.pdfExploit, Third Party Advisory

Published

Mar 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-8739VPN Unlimited 4.2.0 for macOS suffers from a root privilege …
• CVE-2018-8740In SQLite through 3.22.0, databases whose schema is corrupte…
• CVE-2018-8741A directory traversal flaw in SquirrelMail 1.4.22 allows an …
• CVE-2018-8753The IKEv1 implementation in Clavister cOS Core before 11.00.…
• CVE-2018-8754The libevt_record_values_read_event() function in libevt_rec…5.5
• CVE-2018-8755NuCom WR644GACV devices before STA006 allow an attacker to d…
• CVE-2018-8761protected\apps\member\controller\shopcarController.php in Yx…
• CVE-2018-8763Roland Gruber Softwareentwicklung LDAP Account Manager befor…
• CVE-2018-8764Roland Gruber Softwareentwicklung LDAP Account Manager befor…
• CVE-2018-8765In 2345 Security Guard 3.6, the driver file (2345NetFirewall…
• CVE-2018-8766joyplus-cms 1.6.0 allows Remote Code Execution because of an…
• CVE-2018-8767joyplus-cms 1.6.0 has XSS in manager/admin_ajax.php?action=s…