Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
186 results · page 1 of 4
Oct 26, 2026A vulnerability was determined in DedeCMS 5.7.118.CVE-2026-116253 · Other software · reported by VulDBMedium 6.9
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026A weakness has been identified in DedeCMS up to 5.7.118.CVE-2026-116063 · Other software · reported by VulDBLow 2
A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and inclCVE-2021-48016 · Other software · DedeCMS · reported by VulnCheckCritical 9.3
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- DedeCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized inpuCVE-2014-125131 · Other software · DedeCMS · reported by VulnCheckMedium 5.1
DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
- Product
- DedeCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2026A vulnerability was found in DedeCMS up to 5.7.118.CVE-2026-94004 · Other software · reported by VulDBMedium 5.5
A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytag_js.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026A flaw has been found in DeDeCMS 3.CVE-2026-76800 · Other software · reported by VulDBLow 2.1
A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduvxbywu62qm.feishu.cnvuldb.com
Aug 19, 2026A security vulnerability has been detected in DeDeCMS 53_1_UTF8.CVE-2026-76783 · Other software · reported by VulDBMedium 5.5
A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorduvxbywu62qm.feishu.cnvuldb.com
Aug 9, 2026A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2.CVE-2026-19353 · Other software · reported by VulDBLow 1.3
A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2026A security flaw has been discovered in DedeCMS 5.7.118.CVE-2026-15700 · Other software · reported by VulDBLow 2
A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026A security flaw has been discovered in DedeCMS 5.7.118.CVE-2026-15533 · Other software · reported by VulDBLow 2
A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a manipulation of the argument Column Name results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.CVE-2026-38615 · Other software · reported by MITRECritical 9.8
DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026A security flaw has been discovered in DedeCMS 5.7.88.CVE-2026-10608 · Other software · reported by VulDBMedium 5.5
A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulation of the argument postname/des results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026A vulnerability was identified in DedeCMS 5.7.88.CVE-2026-10607 · Other software · reported by VulDBMedium 5.5
A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dede_htmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026A vulnerability was determined in DedeCMS 5.7.88.CVE-2026-10606 · Other software · reported by VulDBMedium 5.5
A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026A flaw has been found in DedeCMS 5.7.88.CVE-2026-10581 · Other software · reported by VulDBLow 2.1
A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64_decode of the file /plus/download.php?open=1. This manipulation of the argument Link causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.CVE-2026-30643 · Other software · Dedecms · reported by MITRECritical 9.8
An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comdedecms.com
Mar 24, 2026DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.CVE-2026-29839 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comdedecms.com
Mar 19, 2026An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter componentCVE-2026-30694 · Other software · Dedecms · reported by MITRECritical 9.8
An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjacobjacobjacob.gitbook.ioleixyous-personal-organization.gitbook.io
Dec 29, 2025DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.CVE-2024-30855 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 21, 2025A vulnerability was identified in DedeCMS up to 5.7.118.CVE-2025-15004 · Other software · Dedecms · reported by VulDBLow 2.1
A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation of the argument orderby leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Jun 20, 2025A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical.CVE-2025-6335 · Other software · Dedecms · reported by VulDBLow 2
A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical. This issue affects some unknown processing of the file /include/dedetag.class.php of the component Template Handler. The manipulation of the argument notes leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2025A vulnerability was found in DedeCMS 5.7.117.CVE-2025-5137 · Other software · Dedecms · reported by VulDBMedium 5.1
A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sys_verifies.php?action=getfiles of the component Incomplete Fix CVE-2018-9175. The manipulation of the argument refiles leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Dedecms 5.71sp1 and earlier is vulnerable to URL redirect.CVE-2024-57241 · Other software · Dedecms · reported by MITREMedium 6.5
Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirection.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116.CVE-2024-12183 · Other software · dedecms · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of the component HTTP POST Request Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.116.CVE-2024-12182 · Other software · dedecms · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.116. Affected by this issue is some unknown functionality of the file /member/soft_add.php. The manipulation of the argument body leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024A vulnerability classified as problematic was found in DedeCMS 5.7.116.CVE-2024-12181 · Other software · dedecms · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in DedeCMS 5.7.116. Affected by this vulnerability is an unknown functionality of the file /member/uploads_add.php of the component SWF File Handler. The manipulation of the argument mediatype leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024A vulnerability classified as problematic has been found in DedeCMS 5.7.116.CVE-2024-12180 · Other software · dedecms · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in DedeCMS 5.7.116. Affected is an unknown function of the file /member/article_add.php. The manipulation of the argument body leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024A vulnerability classified as problematic has been found in DedeCMS 5.7.116.CVE-2024-11138 · Other software · dedecms · reported by VulDBMedium 5.1
A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. The manipulation of the argument logoimg leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024A vulnerability was found in DedeCMS up to 5.7.115.CVE-2024-9076 · Other software · dedecms · reported by VulDBMedium 5.1
A vulnerability was found in DedeCMS up to 5.7.115. It has been rated as critical. This issue affects some unknown processing of the file /dede/article_string_mix.php. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.CVE-2024-46373 · Other software · dedecms · reported by MITREHigh 8.8
Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2024DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module.CVE-2024-46372 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2024DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.CVE-2024-42636 · Other software · dedecms · reported by MITREHigh 7.2
DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2024A vulnerability was found in DedeCMS 5.7.114.CVE-2024-6940 · Other software · dedecms · reported by VulDBMedium 5.1
A vulnerability was found in DedeCMS 5.7.114. It has been classified as critical. This affects an unknown part of the file article_template_rand.php. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271995. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2024An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted fCVE-2024-35510 · Other software · dedecms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted file.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2024There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMSCVE-2024-35375 · Other software · dedecms · reported by MITRECritical 9.8
There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordshtaoism.comgist.github.com
May 17, 2024DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys_data_replace.php.CVE-2024-34959 · Other software · dedecms · reported by MITREMedium 5.5
DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys_data_replace.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A vulnerability classified as problematic has been found in DedeCMS 5.7.114.CVE-2024-4790 · Other software · Dedecms · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in DedeCMS 5.7.114. This affects an unknown part of the file /sys_verifies.php?action=view. The manipulation of the argument filename with the input ../../../../../etc/passwd leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263889 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024An arbitrary file read vulnerability in DedeCMS v5.7.114 allows authenticated attackers to read arbitrary files by specifying any path in makehtml_js_action.phpCVE-2024-34245 · Other software · Dedecms · reported by MITREMedium 6.5
An arbitrary file read vulnerability in DedeCMS v5.7.114 allows authenticated attackers to read arbitrary files by specifying any path in makehtml_js_action.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.CVE-2024-4594 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. Affected is an unknown function of the file /src/dede/sys_safe.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263316. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.CVE-2024-4593 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. This issue affects some unknown processing of the file /src/dede/sys_multiserv.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability classified as problematic was found in DedeCMS 5.7.CVE-2024-4592 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/sys_group_edit.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-263314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability classified as problematic has been found in DedeCMS 5.7.CVE-2024-4591 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/sys_group_add.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability was found in DedeCMS 5.7.CVE-2024-4590 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/sys_info.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263312. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability was found in DedeCMS 5.7.CVE-2024-4589 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede/mytag_edit.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263311. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability was found in DedeCMS 5.7.CVE-2024-4588 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/mytag_add.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-263310 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability was found in DedeCMS 5.7 and classified as problematic.CVE-2024-4587 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability was found in DedeCMS 5.7 and classified as problematic. This issue affects some unknown processing of the file /src/dede/tpl.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263309 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability has been found in DedeCMS 5.7 and classified as problematic.CVE-2024-4586 · Other software · dedecms · reported by VulDBMedium 4.3
A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/shops_delivery.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-263308. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.CVE-2024-4585 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/member_type.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-263307. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2024DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php.CVE-2024-33749 · Other software · dedecms · reported by MITRECritical 9.1
DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the makehtml_list_action.CVE-2024-33371 · Other software · dedecms · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the makehtml_list_action.php component.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.