1703 matches found
CVE-2018-9175
DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselectmain.php because code within the database is accessible to uploads/dede/syscacheup.php...
CVE-2018-9175
DedeCMS 5.7 contains a remote code execution vulnerability (CVE-2018-9175) via the egroup parameter to uploads/dede/stepselect_main.php. The attack leverages that code written into the database can be exposed to uploads/dede/sys_cache_up.php, enabling an attacker to inject PHP through database-ba...
DedeCMS Arbitrary PHP Code Execution Vulnerability
Weaving dream content management system DedeCms is a set of simple, robust, flexible, open source several characteristics of open source content management system. DedeCMS 5.7 has an arbitrary PHP code execution vulnerability. The vulnerability arises because uploads/dede/syscacheup.php can acces...
DedeCMS Arbitrary PHP Code Execution Vulnerability (CNVD-2018-08145)
Dream content management system DedeCms is a set of simple, robust, flexible, open source several characteristics of open source content management system. An arbitrary PHP code execution vulnerability exists in sysverifies.php in DedeCMS 5.7. The vulnerability arises because an attacker can...
PT-2018-18906 · Dedecms · Dedecms
Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the egroup parameter to the "/uploads/dede/stepselect main.php" API endpoint, as code within the database is accessible to...
File Upload Vulnerability in DedeCMS v5.7 SP2
Weaving dream content management system DedeCms is a PHP open source website management system. DedeCMS V5.7 SP2 version of the dede/archivesdo.php file file upload vulnerability, an attacker can use the vulnerability to upload script files to obtain webshell...
CVE-2018-9134
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
Cross site request forgery (csrf)
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
CVE-2018-9134
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
CVE-2018-9134
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
CVE-2018-9134
filemanagecontrol.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters...
CVE-2018-9134
The CVE-2018-9134 entry describes a CSRF flaw in file_manage_control.php in DedeCMS 5.7 where the fmdo=rename action allows an attacker to rename a file under uploads/userup to a .php file in the web root, enabling PHP code execution. Root cause: CSRF in the rename action; impact: potential remot...
CVE-2018-7700
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code...
Cross site request forgery (csrf)
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code...
CVE-2018-7700
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code...
CVE-2018-7700
DedeCMS 5.7 (including 5.7SP2) is vulnerable to CSRF that can lead to arbitrary code execution via the partcode parameter in tag_test_action.php (runphp field with PHP code). Exploitation appears in the wild (2025), and remediation is to apply security patches/update to a newer DedeCMS version. A...
CVE-2018-7700
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code...
