1703 matches found
CVE-2019-6289
uploads/include/dialog/selectsoft.php in DedeCMS V57UTF8SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrated by the 1.pHP filename...
DedeCMS Arbitrary PHP Code Execution Vulnerability (CNVD-2019-04908)
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A security vulnerability exists in...
DedeCMS suffers from an information disclosure vulnerability (CNVD-2019-05347)
Dream Content Management System DedeCMS is a PHP open source website management system. DedeCMS suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
Desdev DedeCMS File Upload Vulnerability
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval of PHP Web site content management system CMS. Desdev DedeCMS 5.7 SP2 version of the...
CVE-2018-20129
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...
Design/Logic Flaw
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...
CVE-2018-20129
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...
CVE-2018-20129
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...
CVE-2018-20129
Summary: CVE-2018-20129 affects DedeCMS v5.7 SP2 in uploads/include/dialog/select_images_post.php, enabling uploaded PHP code execution via a crafted filename using a double extension and manipulated ".php" substring, in conjunction with image/jpeg content type. The vulnerability mechanism is a f...
DedeCMS SQL Injection Vulnerability (CNVD-2019-07021)
Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...
CVE-2018-19061
DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...
Sql injection
DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...
CVE-2018-19061
DedeCMS 5.7 SP2 has SQL Injection via the dede\codo.php ids parameter...
CVE-2018-19061
DedeCMS 5.7 SP2 is affected by a SQL Injection vulnerability in the dede\co_do.php ids parameter. The issue stems from improper handling of the IDs input, allowing an attacker to modify and inject arbitrary SQL commands. This vulnerability is documented as CVE-2018-19061 and is rated HIGH/CRITICA...
SQL injection vulnerability in DedeCMS co***.php file
Dream Content Management System DedeCMS is a PHP open source website management system. A SQL injection vulnerability exists in the DedeCMS co.php file. An attacker can exploit the vulnerability to obtain sensitive database information...
CVE-2018-18781
DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...
CVE-2018-18782
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...
CVE-2018-18781
DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...