CVE-2025-64048 identifies a stored XSS vulnerability in YCCMS 3.4 affecting the article management feature. Specifically, the add() and getPost() functions in ArticleAction.class.php do not properly sanitize user input in the article title field, enabling injection of malicious scripts. This vulnerability requires user interaction (UI:R) but can be exploited remotely (AV:N) without privileges (PR:N). The impact includes limited confidentiality and integrity loss but no availability impact, as reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

An attacker can inject and store malicious scripts in article titles, which execute when other users view the affected content. This can lead to partial confidentiality and integrity compromise of user data or session information. There is no direct impact on system availability. The vulnerability is exploitable remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with article titles from untrusted sources. Implementing input validation or output encoding on the article title field may reduce risk.