Design/Logic Flaw

An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...

CVE-2018-20129

Summary: CVE-2018-20129 affects DedeCMS v5.7 SP2 in uploads/include/dialog/select_images_post.php, enabling uploaded PHP code execution via a crafted filename using a double extension and manipulated ".php" substring, in conjunction with image/jpeg content type. The vulnerability mechanism is a f...

CVE-2018-20129

An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...

DedeCMS SQL Injection Vulnerability (CNVD-2019-07021)

Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...

CVE-2018-19061

DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...

Sql injection

DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...

CVE-2018-19061

DedeCMS 5.7 SP2 is affected by a SQL Injection vulnerability in the dede\co_do.php ids parameter. The issue stems from improper handling of the IDs input, allowing an attacker to modify and inject arbitrary SQL commands. This vulnerability is documented as CVE-2018-19061 and is rated HIGH/CRITICA...

CVE-2018-19061

DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...

SQL injection vulnerability in DedeCMS co***.php file

Dream Content Management System DedeCMS is a PHP open source website management system. A SQL injection vulnerability exists in the DedeCMS co.php file. An attacker can exploit the vulnerability to obtain sensitive database information...

CVE-2018-18781

DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...

CVE-2018-18782

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

CVE-2018-18782

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

CVE-2018-18781

DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...

Cross site scripting

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

Cross site scripting

DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...

CVE-2018-18782

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...

CVE-2018-18781

DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...

CVE-2018-18782

CVE-2018-18782 affects DedeCMS 5.7 SP2, with a Reflected XSS in the /member/myfriend.php ftype parameter. The root cause is the unescaped ftype input reflected in the page, enabling injection of arbitrary scripts. Documents do not provide exploitation status, in-the-wild details, or specific reme...

CVE-2018-18781

DedeCMS 5.7 SP2 is affected by a cross-site scripting (XSS) vulnerability in the /member/uploads_select.php endpoint, exploitable via the keyword parameter. The issue is caused by improper handling of input in that parameter, enabling injection of arbitrary scripts. The CVE-2018-18781 entry is co...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2019-01727)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/myfriend.php file in DedeCMS version 5.7 SP2, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'fype' parameter...