CVE-2020-18114

An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format...

CVE-2020-18114

An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format...

PT-2021-10130

Name of the Vulnerable Software and Affected Versions: DedeCMS version V5.7SP2 Description: An arbitrary file upload vulnerability in the "/uploads/dede" component allows attackers to upload a webshell in HTM format. Recommendations: For DedeCMS version V5.7SP2, consider disabling the...

Desdev DedeCMS code-related vulnerabilities

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing , content management , content editing and content retrieval functions. A security vulnerability exists in th...

CVE-2020-18114: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format...

CVE-2020-16632

A XSS Vulnerability in /uploads/dede/actionsearch.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter...

PT-2021-9873

Name of the Vulnerable Software and Affected Versions DedeCMS version V5.7 SP2 Description A XSS issue in the "/uploads/dede/action search.php" endpoint allows an authenticated user to execute remote arbitrary code via the keyword parameter. Recommendations For DedeCMS version V5.7 SP2, as a...

dedecmscan

This is a Python-based vulnerability scanner for the DedeCMS platform. The scanner is designed to identify potential vulnerabilities in the platform, including SQL injection, cross-site scripting XSS, and other types of attacks. The scanner consists of several modules, each responsible for...

Code Execution Vulnerability in DedeCMS of Shanghai Zhuozhuo Network Technology Company Limited (CNVD-2020-49285)

DedeCMS is an open source content management system. Shanghai Zhuozhuo Network Technology Co., Ltd DedeCMS has a code execution vulnerability that can be exploited by attackers to gain server control privileges...

dedecmscan

This is a Python script designed to scan for vulnerabilities in DedeCMS, a content management system. The script is called "dedescan" and is written in Python 3. It uses various techniques to identify potential vulnerabilities, including SQL injection, cross-site scripting XSS, and path traversal...

PT-2019-18988

Name of the Vulnerable Software and Affected Versions DedeCMS versions through V5.7SP2 Description The issue allows for arbitrary file upload in certain PHP files. This can be achieved by sending a request to specific API endpoints, such as "/dede/album edit.php" or "/dede/album add.php", with a...

CVE-2019-8362: Unrestricted Upload of File with Dangerous Type

DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...

CVE-2018-19061

DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...

CVE-2018-19061: Improper Neutralization of Special Elements used in an SQL Command

DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2019-01728)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/uploadsselect.php file in DedeCMS version 5.7 SP2, which can be exploited by a remote attacker with the help of the 'f' or 'keyword' parameter to A remote attacker can use the 'f' ...

CVE-2018-18608

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...

CVE-2018-16784

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

CVE-2018-12045

DedeCMS through V5.7SP2 allows arbitrary file upload in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file...

CVE-2018-12045: Unrestricted Upload of File with Dangerous Type

DedeCMS through V5.7SP2 allows arbitrary file upload in dede/filemanagecontrol.php via a dede/filemanageview.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file...

PT-2018-10966

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to V5.7SP2 Description The issue allows for arbitrary file upload. This can be achieved by sending a request to the /dede/file manage view.php?fmdo=upload endpoint with a malicious upfile1 parameter, enabling the upload ...