1718 matches found
CVE-2018-20129
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...
CVE-2018-20129
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...
CVE-2018-20129
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...
CVE-2018-20129
Summary: CVE-2018-20129 affects DedeCMS v5.7 SP2 in uploads/include/dialog/select_images_post.php, enabling uploaded PHP code execution via a crafted filename using a double extension and manipulated ".php" substring, in conjunction with image/jpeg content type. The vulnerability mechanism is a f...
DedeCMS SQL Injection Vulnerability (CNVD-2019-07021)
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...
CVE-2018-19061
DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...
Sql injection
DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...
CVE-2018-19061
DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...
CVE-2018-19061
DedeCMS 5.7 SP2 is affected by a SQL Injection vulnerability in the dede\co_do.php ids parameter. The issue stems from improper handling of the IDs input, allowing an attacker to modify and inject arbitrary SQL commands. This vulnerability is documented as CVE-2018-19061 and is rated HIGH/CRITICA...
SQL injection vulnerability in DedeCMS co***.php file
Dream Content Management System DedeCMS is a PHP open source website management system. A SQL injection vulnerability exists in the DedeCMS co.php file. An attacker can exploit the vulnerability to obtain sensitive database information...
CVE-2018-18782
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...
CVE-2018-18781
DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...
CVE-2018-18781
DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...
CVE-2018-18782
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...
Cross site scripting
DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...
Cross site scripting
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...
CVE-2018-18782
CVE-2018-18782 affects DedeCMS 5.7 SP2, with a Reflected XSS in the /member/myfriend.php ftype parameter. The root cause is the unescaped ftype input reflected in the page, enabling injection of arbitrary scripts. Documents do not provide exploitation status, in-the-wild details, or specific reme...
CVE-2018-18782
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...
CVE-2018-18781
DedeCMS 5.7 SP2 is affected by a cross-site scripting (XSS) vulnerability in the /member/uploads_select.php endpoint, exploitable via the keyword parameter. The issue is caused by improper handling of input in that parameter, enabling injection of arbitrary scripts. The CVE-2018-18781 entry is co...