CVE-2018-18579

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...

CVE-2018-18578

CVE-2018-18578 affects DedeCMS 5.7 SP2. A cross-site scripting vulnerability exists in the plus/qrcode.php page via the type parameter, enabling injected script in affected contexts. Documented by multiple sources (CNVD, RH Red Hat, NVD, CVE list). Exploit details and fixes are not provided in th...

CVE-2018-18578

DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...

CVE-2018-18579

DedeCMS 5.7 SP2 is affected by a reflected XSS vulnerability in the /member/pm.php endpoint, exploitable via the folder parameter. The vulnerable component is DedeCMS’s web interface; input in the folder parameter can be reflected back to the user, enabling arbitrary script/HTML execution in a us...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-19871)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /plus/feedbackajax.php file in DedeCMS version 5.7 SP2, which can be exploited by remote attackers to execute JavaScript code with the help of the onhashchange attribute in the 'msg'...

Design/Logic Flaw

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

CVE-2018-16786

DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...

Cross site scripting

DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...

CVE-2018-16784

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

CVE-2018-16786

DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...

CVE-2018-16784

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "file type='file' name='../" substring...

CVE-2018-16786

CVE-2018-16786 concerns DedeCMS 5.7 SP2, where a Cross-Site Scripting (XSS) flaw exists in the /plus/feedback_ajax.php file. The vulnerability is triggered via an onhashchange attribute in the msg parameter, allowing arbitrary JavaScript execution in the context of the affected user. The availabl...

CVE-2018-16784

CVE-2018-16784 concerns DedeCMS 5.7 SP2, where an XML injection allows remote code execution via a crafted substring "<file type='file' name='../". The connected documents provide the vulnerability description and NVD metrics, indicating network access with low complexity and partial to high i...

CVE-2018-16786

DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedbackajax.php...

DedeCMS File Write Vulnerability

DedeCMS is a PHP-based web content management system CMS. A file write vulnerability exists in files in DedeCMS version 5.7 SP2, which can be exploited by an attacker to create a script file and obtain a webshell...

File Upload Vulnerability in DedeCMS v5.7 SP2

Dream Content Management System DedeCMS is a PHP open source website management system. A file upload vulnerability exists in DedeCMS v5.7 SP2. Attackers can exploit the vulnerability to upload image Trojans and gain server privileges...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

Design/Logic Flaw

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

The connected sources confirm a concrete vulnerability in DedeCMS v5.7 SP2 (PHP-based CMS): a file-write flaw that attackers can exploit to write a script file and obtain a webshell. This CVE (CVE-2018-16785) is described as affecting DedeCMS 5.7 SP2 with XML injection/file-write mechanics enabli...