CVE-2025-56304 is a cross-site scripting (XSS) vulnerability in YzmCMS through version 7.3. The vulnerability is triggered by malicious input in the HTTP referer header on the register page, which is not properly sanitized. This allows an attacker to execute arbitrary scripts in the context of the victim's browser session. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact affects confidentiality and integrity with no impact on availability. There is no information about an official patch or vendor advisory at this time.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of sensitive information or session hijacking. The vulnerability affects confidentiality and integrity but does not impact system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing input validation or filtering on the referer header if possible, and educate users about the risks of interacting with untrusted links. Monitor official YzmCMS channels for updates and patches.