CVE-2026-13529 is a SQL injection vulnerability affecting YzmCMS versions 7.0 to 7.5. It exists in an unspecified function within /application/install/index.php, where manipulation of the 'siteurl' parameter can lead to injection of SQL commands. The attack can be performed remotely without authentication, but requires high complexity and is difficult to exploit. The vendor has not provided any response or patch following early notification. The vulnerability has been publicly disclosed, increasing the risk of potential exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of YzmCMS, potentially leading to unauthorized data access or modification. However, the high complexity and difficult exploitability reduce the likelihood of widespread exploitation. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the installation script or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'siteurl' parameter.