2058 matches found
CVE-2018-18579
DedeCMS 5.7 SP2 is affected by a reflected XSS vulnerability in the /member/pm.php endpoint, exploitable via the folder parameter. The vulnerable component is DedeCMS’s web interface; input in the folder parameter can be reflected back to the user, enabling arbitrary script/HTML execution in a us...
CVE-2018-18579
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...
PT-2018-14525
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description A reflected XSS issue exists, allowing potential exploitation via the "folder" parameter in the /member/pm.php endpoint. Recommendations For DedeCMS version 5.7 SP2, update to a newer version that contains a...
PT-2018-14524
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description The issue allows for XSS attacks via the type parameter in the plus/qrcode.php endpoint. Recommendations For DedeCMS version 5.7 SP2, update the plus/qrcode.php file to properly sanitize the type parameter t...
CVE-2018-18579: Improper Neutralization of Input During Web Page Generation
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...
CVE-2018-18578: Improper Neutralization of Input During Web Page Generation
DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...
DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-19871)
DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /plus/feedbackajax.php file in DedeCMS version 5.7 SP2, which can be exploited by remote attackers to execute JavaScript code with the help of the onhashchange attribute in the 'msg'...
Cross site scripting
DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...
CVE-2018-16786
DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...
CVE-2018-16784
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...
CVE-2018-16786
DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...
Design/Logic Flaw
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...
CVE-2018-16784
CVE-2018-16784 concerns DedeCMS 5.7 SP2, where an XML injection allows remote code execution via a crafted substring "<file type='file' name='../". The connected documents provide the vulnerability description and NVD metrics, indicating network access with low complexity and partial to high i...
CVE-2018-16786
CVE-2018-16786 concerns DedeCMS 5.7 SP2, where a Cross-Site Scripting (XSS) flaw exists in the /plus/feedback_ajax.php file. The vulnerability is triggered via an onhashchange attribute in the msg parameter, allowing arbitrary JavaScript execution in the context of the affected user. The availabl...
CVE-2018-16786
DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...
CVE-2018-16784
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...
DedeCMS File Write Vulnerability
DedeCMS is a PHP-based web content management system CMS. A file write vulnerability exists in files in DedeCMS version 5.7 SP2, which can be exploited by an attacker to create a script file and obtain a webshell...
PT-2018-13746
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description The issue allows for XML injection, which can lead to remote code execution. This is achieved by using a specific substring: "file type='file' name='../" in an API request. Recommendations For DedeCMS versio...
CVE-2018-16786: Improper Neutralization of Input During Web Page Generation
DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...