CVE-2026-29933 is a reflected XSS vulnerability affecting the /index/login.html component of YZMCMS v7.4. An attacker can exploit this by modifying the HTTP referrer header to inject and execute arbitrary JavaScript code within the victim's browser session. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the user's browser, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with the affected component and consider implementing web application firewall (WAF) rules to detect and block suspicious referrer header manipulations related to this vulnerability.