2058 matches found
CVE-2019-10014
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated...
CVE-2019-10014
CVE-2019-10014 affects DedeCMS 5.7SP2. The vulnerability is in member/resetpassword.php, where remote authenticated users can reset the passwords of arbitrary users by modifying the id parameter because the key parameter is not properly validated. This allows unauthorized password resets within t...
PT-2019-11286
Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7SP2 Description: The issue allows remote authenticated users to reset the passwords of arbitrary users. This is possible due to improper validation of the key parameter in the member/resetpassword.php script, which can be...
CVE-2019-10014: Incorrect Authorization
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated...
There is an information leakage vulnerability in dedecms
Dream Content Management System DedeCMS is a PHP open source website management system. DedeCMS suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...
File Upload Vulnerability in DedeCMS V5.7
DedeCMS Dream Weaving Content Management System is China's Zhuozhuo Network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. DedeCMS V5.7 file upload vulnerability, a...
DedeCMS V5.7 Arbitrary File Deletion Vulnerability
DedeCMS Dream Weaving Content Management System is China's Zhuozhuo Network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. DedeCMS V5.7 arbitrary file deletion...
File upload vulnerability in DedeCMS fi***_cl***.php file
Dream Content Management System DedeCMS is a PHP open source website management system. A file upload vulnerability exists in the DedeCMS ficl.php file. Allows an attacker to upload a webshell and gain server privileges...
CVE-2019-8933
In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...
Directory traversal
In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...
CVE-2019-8933
In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...
CVE-2019-8933
In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...
CVE-2019-8933
CVE-2019-8933 affects DedeCMS 5.7SP2. An attacker can upload a PHP file to uploads/ and execute it by abusing the management/template workflow: navigate to Default Template Management, create a New Template, and alter the filename from ../index.html to ../index.php. This indicates a path/filename...
PT-2019-19268
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7SP2 Description The issue allows attackers to upload a .php file to the uploads/ directory and then execute it. This can be achieved by visiting the management page, clicking on the template, clicking on Default Template...
CVE-2019-8933: Unrestricted Upload of File with Dangerous Type
In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...
CVE-2019-8362
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...
Input validation
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...
CVE-2019-8362
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...
CVE-2019-8362
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/albumedit.php or dede/albumadd.php, as demonstrated by a dede/albumedit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" because input validation only checks that .jpg, .png, or .gif is prese...
CVE-2019-8362
DedeCMS prior to or including V5.7SP2 is affected by an arbitrary file upload vulnerability in dede/album_edit.php and dede/album_add.php. The issue arises because input validation only checks that the filename contains a substring of .jpg, .png, or .gif, and does not otherwise validate the file ...