# CVE-2026-75417: YzmCMS SQL injection in category management

Source: https://junglewise.ai/threats/cve-2026-75417-yzmcms-sql-injection-in-category-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75417 · Severity: high · CVSS 7.2 · Published 2026-08-28

YzmCMS is a lightweight open-source content management system used to build websites. A SQL injection vulnerability in the category management function allows authenticated administrators to execute arbitrary database queries, potentially exposing or modifying all data stored in the database.

Technologies: [YzmCMS](https://junglewise.ai/threats/technologies/yzmcms). Vendors: [YzmCMS](https://junglewise.ai/threats/vendors/yzmcms).

## Quick answers

**Is CVE-2026-75417 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75417 being exploited in the wild.

**How severe is CVE-2026-75417?** High severity, with a CVSS score of 7.2, published 28 August 2026.

**Which products and versions are affected?** YzmCMS 7.5.

**Is there a fix for CVE-2026-75417?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75417 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75417?** Check whether you run YzmCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a SQL injection flaw in the get_arrchildid() function within application/admin/controller/category.class.php. The parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization or parameterized queries. An authenticated administrator can exploit this via boolean-based blind SQL injection to execute arbitrary queries against the database. The vulnerability requires admin authentication, but allows full database compromise once authenticated.

## Affected products

- YzmCMS YzmCMS 7.5

## Timeline

- 2026-08-28: disclosed

## References

- [https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75417](https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75417)
- [https://github.com/yzmcms/yzmcms](https://github.com/yzmcms/yzmcms)

## Related threats

- [YzmCMS XSS via Host Header Injection in Header Handler](https://junglewise.ai/threats/cve-2026-15202-yzmcms-xss-via-host-header-injection-in-header-handler)
- [YzmCMS SQL injection in installation module](https://junglewise.ai/threats/cve-2026-13529-yzmcms-sql-injection-in-installation-module)
- [YzmCMS cross-site scripting in register page referer header](https://junglewise.ai/threats/cve-2025-56304-yzmcms-cross-site-scripting-in-register-page-referer-header)