CVE-2018-20129

Summary: CVE-2018-20129 affects DedeCMS v5.7 SP2 in uploads/include/dialog/select_images_post.php, enabling uploaded PHP code execution via a crafted filename using a double extension and manipulated ".php" substring, in conjunction with image/jpeg content type. The vulnerability mechanism is a f...

DedeCMS SQL Injection Vulnerability (CNVD-2019-07021)

Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...

CVE-2018-19061

DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...

Sql injection

DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...

CVE-2018-19061

DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...

CVE-2018-19061

DedeCMS 5.7 SP2 is affected by a SQL Injection vulnerability in the dede\co_do.php ids parameter. The issue stems from improper handling of the IDs input, allowing an attacker to modify and inject arbitrary SQL commands. This vulnerability is documented as CVE-2018-19061 and is rated HIGH/CRITICA...

SQL injection vulnerability in DedeCMS co***.php file

Dream Content Management System DedeCMS is a PHP open source website management system. A SQL injection vulnerability exists in the DedeCMS co.php file. An attacker can exploit the vulnerability to obtain sensitive database information...

CVE-2018-18781

DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...

CVE-2018-18782

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

CVE-2018-18781

DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...

CVE-2018-18782

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

Cross site scripting

DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...

Cross site scripting

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

CVE-2018-18782

CVE-2018-18782 affects DedeCMS 5.7 SP2, with a Reflected XSS in the /member/myfriend.php ftype parameter. The root cause is the unescaped ftype input reflected in the page, enabling injection of arbitrary scripts. Documents do not provide exploitation status, in-the-wild details, or specific reme...

CVE-2018-18782

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

CVE-2018-18781

DedeCMS 5.7 SP2 is affected by a cross-site scripting (XSS) vulnerability in the /member/uploads_select.php endpoint, exploitable via the keyword parameter. The issue is caused by improper handling of input in that parameter, enabling injection of arbitrary scripts. The CVE-2018-18781 entry is co...

CVE-2018-18781

DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2019-01727)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/myfriend.php file in DedeCMS version 5.7 SP2, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'fype' parameter...

DedeCMS has information leakage vulnerability

Dream Content Management System DedeCMS is a PHP open source website management system. An information disclosure vulnerability exists in DedeCMS. An attacker can exploit the vulnerability to obtain sensitive user information that is publicly available on some websites...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-21787)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the 'GetPageList' function in the include/datalistcp.class.php file in DedeCMS version 5.7 SP2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...