CVE-2020-18917

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

Code injection

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

CVE-2020-18917

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

CVE-2020-18917

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

CVE-2020-18917

CVE-2020-18917 concerns DedeCMS 5.7 SP2 where the plus/search.php component allows remote attackers to execute arbitrary PHP code. The root cause is that the contents of typename.inc are under an attacker’s control, enabling code injection through the typename parameter. Multiple connected source...

DedeCMS跨站请求伪造漏洞

DedeCMS Weaving Dream Content Management System is an open source content management system that is simple, robust, flexible, and open source. an arbitrary PHP code execution vulnerability exists in the plus/search.php component of DedeCMS 5.7 SP2. The vulnerability stems from the contents of...

PT-2021-10255

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 SP2 Description: The issue allows remote attackers to execute arbitrary PHP code via the typename parameter in the plus/search.php component. This is possible because the contents of typename.inc are under an attacker's...

CVE-2020-18917: Cross-Site Request Forgery (CSRF)

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

CVE-2020-22198

SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajaxmembergroup.php...

CVE-2020-22198

SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajaxmembergroup.php...

Sql injection

SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajaxmembergroup.php...

CVE-2020-22198

SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajaxmembergroup.php...

CVE-2020-22198

CVE-2020-22198 corresponds to a SQL injection vulnerability in DedeCMS 5.7, exploitable via the mdescription parameter to member/ajax_membergroup.php. The connected documents confirm the affected product (DedeCMS 5.7) and the vulnerable component/entry point, but do not provide specific exploit d...

Desdev DedeCMS SQL注入漏洞

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing, content management, content editing and content retrieval functions. DedeCMS version 5.7 SQL injection...

PT-2021-10742

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 Description The issue is related to a SQL Injection vulnerability. It can be exploited via the mdescription parameter to the "member/ajax membergroup.php" API endpoint. Recommendations For DedeCMS version 5.7, avoid using t...

CVE-2020-22198: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajaxmembergroup.php...

CVE-2021-32073

DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution...

CVE-2021-32073

DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution...

CVE-2020-16632

A XSS Vulnerability in /uploads/dede/actionsearch.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter...

Cross site request forgery (csrf)

DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution...