Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
186 results · page 2 of 4
Apr 29, 2024Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to run arbitrary code via the mnum parameter.CVE-2024-33401 · Other software · dedecms · reported by MITREMedium 4.4
Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to run arbitrary code via the mnum parameter.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php componentCVE-2024-29660 · Other software · dedecms · reported by MITREMedium 5.3
Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php component.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2024A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.CVE-2024-29661 · Other software · dedecms · reported by MITRECritical 9.8
A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic.CVE-2024-3686 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260473 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024A vulnerability, which was classified as critical, was found in DedeCMS 5.7.112-UTF8.CVE-2024-3685 · Other software · dedecms · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in DedeCMS 5.7.112-UTF8. Affected is an unknown function of the file stepselect_main.php. The manipulation of the argument ids leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-260472. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.CVE-2024-30965 · Other software · dedecms · reported by MITREHigh 8.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co_do.php.CVE-2024-30946 · Other software · dedecms · reported by MITREMedium 5.5
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co_do.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112.CVE-2024-3148 · Other software · Dedecms · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file dede/makehtml_archives_action.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258923. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability classified as problematic was found in DedeCMS 5.7.CVE-2024-3147 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/makehtml_map.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability classified as problematic has been found in DedeCMS 5.7.CVE-2024-3146 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtml_rss_action.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258921 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability was found in DedeCMS 5.7.CVE-2024-3145 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/makehtml_js_action.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258920. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability was found in DedeCMS 5.7.CVE-2024-3144 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede/makehtml_spec.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2024A vulnerability was found in DedeCMS 5.7.CVE-2024-3143 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/member_rank.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execuCVE-2024-29684 · Other software · dedecms · reported by MITRECritical 9.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execute arbitrary code.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability has been found in DedeCMS 5.7 and classified as problematic.CVE-2024-2823 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/mda_main.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257710 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.CVE-2024-2822 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/vote_edit.php. The manipulation of the argument aid leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257709 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.CVE-2024-2821 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. Affected by this issue is some unknown functionality of the file /src/dede/friendlink_edit.php. The manipulation of the argument id leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257708. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024A vulnerability classified as problematic was found in DedeCMS 5.7.CVE-2024-2820 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in DedeCMS 5.7. Affected by this vulnerability is an unknown functionality of the file /src/dede/baidunews.php. The manipulation of the argument filename leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257707. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via create file.CVE-2024-28683 · Other software · dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via create file.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php.CVE-2024-28682 · Other software · dedecms · reported by MITREMedium 6.3
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php.CVE-2024-28681 · Other software · dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_add.php.CVE-2024-28680 · Other software · dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_add.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via Photo Collection.CVE-2024-28679 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via Photo Collection.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_description_main.phpCVE-2024-28678 · Other software · dedecms · reported by MITREMedium 6.3
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_description_main.php
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_main.php.CVE-2024-28677 · Other software · dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_main.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via /dede/article_edit.php.CVE-2024-28676 · Other software · dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via /dede/article_edit.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php.CVE-2024-28673 · Other software · dedecms · reported by MITREHigh 8.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php.CVE-2024-28672 · Other software · dedecms · reported by MITREMedium 5.4
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect_main.php.CVE-2024-28671 · Other software · dedecms · reported by MITREHigh 8.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect_main.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_main.php.CVE-2024-28670 · Other software · dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_main.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php.CVE-2024-28669 · Other software · dedecms · reported by MITREMedium 5.4
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.phpCVE-2024-28684 · Other software · dedecms · reported by MITREHigh 8.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.phpCVE-2024-28675 · Other software · dedecms · reported by MITREHigh 8.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychannel_add.phpCVE-2024-28668 · Other software · dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychannel_add.php
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/templets_one_edit.phpCVE-2024-28667 · Other software · dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/templets_one_edit.php
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/media_add.phpCVE-2024-28666 · Other software · dedecms · reported by MITREMedium 5.5
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/media_add.php
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_add.phpCVE-2024-28665 · Other software · dedecms · reported by MITREHigh 8.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_add.php
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php.CVE-2024-28432 · Other software · dedecms · reported by MITREHigh 8.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php.CVE-2024-28431 · Other software · dedecms · reported by MITREHigh 8.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_edit.php.CVE-2024-28430 · Other software · dedecms · reported by MITREMedium 6.1
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_edit.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.phpCVE-2024-28429 · Other software · dedecms · reported by MITREMedium 5.5
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2024Reflected cross-site scripting (XSS) vulnerability in Racktables v0.22.0 and before, allows local attackers to execute arbitrary code and obtain sensitive inforCVE-2023-49453 · Other software · dedecms · reported by MITREMedium 6.1
Reflected cross-site scripting (XSS) vulnerability in Racktables v0.22.0 and before, allows local attackers to execute arbitrary code and obtain sensitive information via the search component in index.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnitipoom-jar.github.ionitipoom-jaroonchaipipat.github.io
Mar 7, 2024Cross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code via the formatCaseNumbCVE-2024-25327 · Other software · dedecms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code via the formatCaseNumber parameter of the Citation search function.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Feb 28, 2024Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager.CVE-2023-52047 · Other software · dedecms · reported by MITREHigh 8.8
Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2024DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.CVE-2024-22895 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2024A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112.CVE-2023-7212 · Other software · Dedecms · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112. Affected is an unknown function of the file file_class.php of the component Backend. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249768. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhmxwjm7x03.feishu.cnvuldb.com
Dec 11, 2023DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.CVE-2023-49494 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php.CVE-2023-49493 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php.CVE-2023-49492 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2023Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted webCVE-2023-43275 · Other software · dedecms · reported by MITREHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.