1697 matches found
CVE-2018-9134
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
Cross site request forgery (csrf)
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
CVE-2018-9134
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
CVE-2018-9134
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
CVE-2018-9134
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
CVE-2018-9134
The CVE-2018-9134 entry describes a CSRF flaw in file_manage_control.php in DedeCMS 5.7 where the fmdo=rename action allows an attacker to rename a file under uploads/userup to a .php file in the web root, enabling PHP code execution. Root cause: CSRF in the rename action; impact: potential remot...
Cross site request forgery (csrf)
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code...
CVE-2018-7700
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code...
CVE-2018-7700
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code...
CVE-2018-7700
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code...
CVE-2018-7700
DedeCMS 5.7 (including 5.7SP2) is vulnerable to CSRF that can lead to arbitrary code execution via the partcode parameter in tag_test_action.php (runphp field with PHP code). Exploitation appears in the wild (2025), and remediation is to apply security patches/update to a newer DedeCMS version. A...
CVE-2018-6910
DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php...
Path traversal
DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php...
CVE-2018-6910
DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php...
CVE-2018-6910
DedeCMS 5.7 is affected by CVE-2018-6910, a path-disclosure vulnerability that allows remote attackers to discover the full server path by requesting include/downmix.inc.php or inc/inc_archives_functions.php. The issue enables information disclosure that can aid further attacks. The Nuclei templa...
Code execution vulnerability in DedeCMS backend cache files
Weaving dream content management system DedeCms is a PHP open source website management system. A code execution vulnerability exists in the DedeCMS backend cache file. The vulnerability is due to the system mishandling of input information , allowing an attacker to exploit the vulnerability...
Reflective Cross-Site Scripting Vulnerability in DedeCMS V5.7 SP2
Weaving dream content management system DedeCms is a PHP open source website management system. A reflective cross-site scripting vulnerability exists in DedeCMS V5.7 SP2. The attacker constructs XSS statements and performs pop-up box operations to obtain user cookies and other information...
DeDecms 任意用户登录,管理员密码重置漏洞
简述 Dedecms是一款开源的PHP开源网站管理系统。 DeDecms织梦CMS V5.7.72 正式版20180109 最新版 前台会员模块是采用Cookie中的 DedeUserID+DedeUserIDckMd5字段进行身份鉴别 DedeUserID用于定位区别用户，DedeUserIDckMd5则是服务器生成散列，用于安全验证 Dedecms一处代码由于逻辑不够严谨，导致可以输入字符并获得服务器生成散列 劫持DedeUserIDckMd5字段，绕过安全校验，配合类型转换造成任意用户登录漏洞 漏洞详细原理 文件位置:dedecms/member/index.php:110行...
Arbitrary user login vulnerability in DeDecms cookie.helper.php file
Weaving dream content management system DedeCms is a PHP open source website management system. There is an arbitrary user login vulnerability in the DeDecms cookie.helper.php file. Attackers can use the vulnerability to bypass the security checks , login any user...