169 matches found
Desdev DedeCMS 代码问题漏洞
Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing , content management , content editing and content retrieval functions. A security vulnerability exists in th...
CVE-2020-16632
A XSS Vulnerability in /uploads/dede/actionsearch.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter...
dedecmscan
This is a Python-based vulnerability scanner for the DedeCMS platform. The scanner is designed to identify potential vulnerabilities in the platform, including SQL injection, cross-site scripting XSS, and other types of attacks. The scanner consists of several modules, each responsible for...
Code Execution Vulnerability in DedeCMS of Shanghai Zhuozhuo Network Technology Company Limited (CNVD-2020-49285)
DedeCMS is an open source content management system. Shanghai Zhuozhuo Network Technology Co., Ltd DedeCMS has a code execution vulnerability that can be exploited by attackers to gain server control privileges...
dedecmscan
This is a Python script designed to scan for vulnerabilities in DedeCMS, a content management system. The script is called "dedescan" and is written in Python 3. It uses various techniques to identify potential vulnerabilities, including SQL injection, cross-site scripting XSS, and path traversal...
CVE-2019-8362: Unrestricted Upload of File with Dangerous Type
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...
CVE-2018-19061
DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...
CVE-2018-19061: Improper Neutralization of Special Elements used in an SQL Command
DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...
DedeCMS Cross-Site Scripting Vulnerability (CNVD-2019-01728)
DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/uploadsselect.php file in DedeCMS version 5.7 SP2, which can be exploited by a remote attacker with the help of the 'f' or 'keyword' parameter to A remote attacker can use the 'f' ...
CVE-2018-18608
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...
CVE-2018-16784
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...
CVE-2018-12045
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file...
CVE-2018-12046: Improper Input Validation
DedeCMS through 5.7SP2 allows arbitrary file write in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file...
CVE-2018-12045: Unrestricted Upload of File with Dangerous Type
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file...
SQL Injection Vulnerability in DedeCMS V5.7-SP2 Version
Dream Content Management System DedeCMS is a PHP open source website management system. SQL injection vulnerability exists in DedeCMS V5.7-SP2 version, which can be exploited by attackers to obtain sensitive database information...
CVE-2018-9175: Improper Control of Generation of Code
DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselectmain.php because code within the database is accessible to uploads/dede/syscacheup.php...
CVE-2018-6910
DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php...
DedeCMS V5.7 SP2 suffers from file upload vulnerability (CNVD-2018-01222)
Weaving dream content management system DedeCms is a PHP open source website management system. DedeCMS V5.7 SP2 version of the dede/tpl.php file file upload vulnerability, an attacker can use the vulnerability to upload script files, can get webshell...
File Upload Vulnerability in DedeCMS V5.7 SP2
Weaving dream content management system DedeCms is a PHP open source website management system. DedeCMS V5.7 SP2 version of the file upload vulnerability exists, the vulnerability is due to the interface failed to effectively filter the uploaded files, the attacker can use the vulnerability to...