# CVE-2026-15202: YzmCMS XSS via Host Header Injection in Header Handler

Source: https://junglewise.ai/threats/cve-2026-15202-yzmcms-xss-via-host-header-injection-in-header-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-15202 · Severity: medium · CVSS 4.3 · Published 2026-07-09

YzmCMS, a content management system, is vulnerable to a security flaw where it fails to verify the website address provided in incoming web requests. An attacker can exploit this by sending a specially crafted request that tricks the system into inserting malicious scripts into the website's pages. If a user views these compromised pages, the attacker could steal login information, redirect users to fraudulent websites, or deface the site's content.

Technologies: [YzmCMS](https://junglewise.ai/threats/technologies/yzmcms). Vendors: [YzmCMS](https://junglewise.ai/threats/vendors/yzmcms).

## Quick answers

**Is CVE-2026-15202 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15202 being exploited in the wild.

**How severe is CVE-2026-15202?** Medium severity, with a CVSS score of 4.3, published 9 July 2026.

**Which products and versions are affected?** YzmCMS Up to 7.5.

**Is there a fix for CVE-2026-15202?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15202 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-15202?** Check whether you run YzmCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in YzmCMS up to version 7.5 due to improper neutralization of the HTTP Host header. The root cause is located in /yzmphp/yzmphp.php, where the 'HTTP_HOST' constant is defined directly from the $_SERVER['HTTP_HOST'] superglobal without validation or whitelisting. This constant is subsequently used by the get_url() function in /yzmphp/core/function/global.func.php to construct SITE_URL and other global constants used in templates. A remote, unauthenticated attacker can manipulate the Host header to inject arbitrary HTML or JavaScript (e.g., breaking out of href attributes). This can lead to session hijacking, phishing, or web cache poisoning. As of the advisory date, the vendor has not responded to disclosure attempts.

## Affected products

- YzmCMS YzmCMS Up to 7.5

## Timeline

- 2026-06-08: disclosed: Initial discovery and PoC created
- 2026-07-09: advisory: CVE published to NVD dataset

## References

- [https://gist.github.com/188452/72d03d030ee3cbfee2642badfa9dce33](https://gist.github.com/188452/72d03d030ee3cbfee2642badfa9dce33)
- [https://vuldb.com/cve/CVE-2026-15202](https://vuldb.com/cve/CVE-2026-15202)
- [https://vuldb.com/submit/851931](https://vuldb.com/submit/851931)
- [https://vuldb.com/vuln/377124](https://vuldb.com/vuln/377124)
- [https://vuldb.com/vuln/377124/cti](https://vuldb.com/vuln/377124/cti)

## Related threats

- [YzmCMS SQL injection in category management](https://junglewise.ai/threats/cve-2026-75417-yzmcms-sql-injection-in-category-management)
- [YzmCMS SQL injection in installation module](https://junglewise.ai/threats/cve-2026-13529-yzmcms-sql-injection-in-installation-module)
- [YzmCMS cross-site scripting in register page referer header](https://junglewise.ai/threats/cve-2025-56304-yzmcms-cross-site-scripting-in-register-page-referer-header)