PT-2018-14646

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description A reflected XSS issue exists due to the "ftype" parameter in the "/member/myfriend.php" API endpoint. Recommendations For DedeCMS version 5.7 SP2, consider restricting access to the "/member/myfriend.php"...

CVE-2018-18781: Improper Neutralization of Input During Web Page Generation

DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...

DedeCMS has information leakage vulnerability

Dream Content Management System DedeCMS is a PHP open source website management system. An information disclosure vulnerability exists in DedeCMS. An attacker can exploit the vulnerability to obtain sensitive user information that is publicly available on some websites...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-21787)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the 'GetPageList' function in the include/datalistcp.class.php file in DedeCMS version 5.7 SP2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross site scripting

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...

CVE-2018-18608

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...

CVE-2018-18608

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...

CVE-2018-18608

Summary of CVE-2018-18608 (DedeCMS 5.7 SP2) : A cross-site scripting vulnerability exists in the GetPageList function (include/datalistcp.class.php) used to render the bottom page-number list, exploitable via PATH_INFO on endpoints such as /member/index.php, /member/pm.php, /member/content_list.p...

CVE-2018-18608: Improper Neutralization of Input During Web Page Generation

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-21795)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/pm.php page in DedeCMS version 5.7 SP2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the 'folder' parameter...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-21796)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the plus/qrcode.php page in DedeCMS version 5.7 SP2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'type' parameter...

PT-2018-14541

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description The issue allows for XSS attacks through the GetPageList function defined in the datalistcp.class.php file. This function is used to display page numbers at the bottom of certain templates. Attacks can be...

CVE-2018-18579

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...

Cross site scripting

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...

CVE-2018-18578

DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...

Cross site scripting

DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...

CVE-2018-18579

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...

CVE-2018-18578

DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...

CVE-2018-18578

DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...

CVE-2018-18578

CVE-2018-18578 affects DedeCMS 5.7 SP2. A cross-site scripting vulnerability exists in the plus/qrcode.php page via the type parameter, enabling injected script in affected contexts. Documented by multiple sources (CNVD, RH Red Hat, NVD, CVE list). Exploit details and fixes are not provided in th...