CVE-2026-90708High· 7.3▾ MidnightPoC availableA weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injectio…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
Exploit / PoC code exists
0.3% → 0.4%
A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108900High· 7.3A vulnerability has been found in Exponent CMS up to 3.0.2patch2
CVE-2026-90709Medium· 4.7A security vulnerability has been detected in Yot CMS up to 3.3.1
CVE-2026-113358High· 7.5LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
CVE-2026-112025High· 7.3light0011 cms Captcha Validation UserController.class.php access control
CVE-2026-112026Low· 3.7light0011 cms UserModel.class.php sha1 weak password hash
CVE-2026-112028Medium· 6.5light0011 cms Vote VoteController.class.php logic error