CVE-2025-5137
🗓️ 25 May 2025 00:00:10Reported by VulDBType 
cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 114 Views🌐 WEB
| Reporter | Title | Published | Views | Family All 22 |
|---|---|---|---|---|
 | CVE-2018-9175 | 2 Apr 201803:29 | – | attackerkb |
 | CVE-2018-9175 | 25 May 202500:46 | – | circl |
| CVE-2025-5137 | 25 May 202500:46 | – | circl |
 | DesDev DedeCMS 注入漏洞 | 25 May 202500:00 | – | cnnvd |
 | DedeCMS Arbitrary PHP Code Execution Vulnerability | 2 Apr 201800:00 | – | cnvd |
| CVE-2018-9175 | 2 Apr 201803:00 | – | cve |
 | CVE-2018-9175 | 2 Apr 201803:00 | – | cvelist |
| CVE-2025-5137 DedeCMS Incomplete Fix CVE-2018-9175 sys_verifies.php code injection | 25 May 202500:00 | – | cvelist |
 | EUVD-2018-20772 | 7 Oct 202500:30 | – | euvd |
| EUVD-2025-16232 | 3 Oct 202520:07 | – | euvd |
10
[
{
"vendor": "n/a",
"product": "DedeCMS",
"versions": [
{
"version": "5.7.117",
"status": "affected"
}
],
"modules": [
"Incomplete Fix CVE-2018-9175"
]
}
]| Source | Link |
|---|---|
| vuldb | www.vuldb.com/ |
| vuldb | www.vuldb.com/ |
| github | www.github.com/CyberPunk-Infernity/Advisory/issues/2 |
| vuldb | www.vuldb.com/ |
| vuldb | www.vuldb.com/ |
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| refiles[0] | query param | dedecms/uploads/dede/sys_verifies.php | Code injection via refiles array to write a PHP payload to an inc file, enabling remote code execution when the file is included. | CWE-74, CWE-94 |
| refiles[1] | query param | dedecms/uploads/dede/sys_verifies.php | Code injection via refiles array to write a PHP payload to an inc file, enabling remote code execution when the file is included. | CWE-74, CWE-94 |
| a | query param | dedecms/uploads/dede/sys_verifies.php | Remote code execution by triggering the down action and passing PHP code via the a parameter to be executed via the included payload. | CWE-74, CWE-94 |
| egroup | query param | dede/stepselect_main.php | Stored PHP code injection via injecting code into the egroup field when adding enumerations; values are written to DB and later cached to a PHP file that can be included. | CWE-74, CWE-94 |
| egroup | query param | dedecms/uploads/dede/sys_cache_up.php | Cache file writing through WriteEnumsCache; injecting PHP code into the egroupp value writes to a cache PHP file that can be executed. | CWE-74, CWE-94 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 09:47Current
5.3Medium risk
Vulners AI Score5.3
CVSS 3.14.7 - 7.2
CVSS 34.7
CVSS 45.1
CVSS 25.8
EPSS0.02171
SSVC