95 matches found
EUVD-2026-49639
An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...
CVE-2026-51078
An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...
CVE-2026-51077
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...
CVE-2026-51077: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...
CVE-2026-51078: Exposure of Sensitive Information to an Unauthorized Actor
An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...
CVE-2026-51078
An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information by manipulating the str parameter within the file_manage_control.php component. No information regarding a newer version containing a fix is currently available. To minimize risk, it is recommended to restrict...
CVE-2026-51078
An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...
CVE-2026-51078
An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...
PT-2026-65304
Name of the Vulnerable Software and Affected Versions Dede CMS version 5.7.118 Description A remote attacker can obtain sensitive information through the 'file manage control.php' component by manipulating the str parameter. Recommendations At the moment, there is no information about a newer...
CVE-2026-15700
A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. The attack can be executed remotely...
CVE-2026-15533
A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a manipulation of the argument Column Name results in code injection. The attack is possible to be carried out remotely. The exploit...
CVE-2026-10608
A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulation of the argument postname/des results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used f...
CVE-2026-10608 DedeCMS carbuyaction.php RemoveXSS sql injection
A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulation of the argument postname/des results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used f...
CVE-2026-10608
A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulation of the argument postname/des results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used f...
CVE-2026-10607
A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dedehtmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used...
EUVD-2026-33878
A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64decode of the file /plus/download.php?open=1. This manipulation of the argument Link causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and...
CVE-2026-30643
An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload...
CVE-2026-29839
DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability in /systaskadd.php...
CVE-2026-29839
DedeCMS v5.7.118 is vulnerable to a Cross-Site Request Forgery (CSRF) attack within the /sys_task_add.php file. The vulnerability allows an attacker to perform unauthorized actions on behalf of a logged-in user. While exploitation details and specific remediation steps are not provided in the doc...
