2058 matches found
PT-2018-14645
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description The issue allows for XSS attacks via the "/member/uploads select.php" endpoint for the keyword parameter. Recommendations For DedeCMS version 5.7 SP2, as a temporary workaround, consider restricting access t...
DedeCMS Cross-Site Scripting Vulnerability (CNVD-2019-01727)
DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/myfriend.php file in DedeCMS version 5.7 SP2, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'fype' parameter...
DedeCMS has information leakage vulnerability
Dream Content Management System DedeCMS is a PHP open source website management system. An information disclosure vulnerability exists in DedeCMS. An attacker can exploit the vulnerability to obtain sensitive user information that is publicly available on some websites...
DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-21787)
DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the 'GetPageList' function in the include/datalistcp.class.php file in DedeCMS version 5.7 SP2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
Cross site scripting
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...
CVE-2018-18608
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...
CVE-2018-18608
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...
CVE-2018-18608
Summary of CVE-2018-18608 (DedeCMS 5.7 SP2) : A cross-site scripting vulnerability exists in the GetPageList function (include/datalistcp.class.php) used to render the bottom page-number list, exploitable via PATH_INFO on endpoints such as /member/index.php, /member/pm.php, /member/content_list.p...
DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-21795)
DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/pm.php page in DedeCMS version 5.7 SP2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the 'folder' parameter...
DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-21796)
DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the plus/qrcode.php page in DedeCMS version 5.7 SP2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'type' parameter...
CVE-2018-18608: Improper Neutralization of Input During Web Page Generation
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php, /member/contentlist.php, or...
PT-2018-14541
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description The issue allows for XSS attacks through the GetPageList function defined in the datalistcp.class.php file. This function is used to display page numbers at the bottom of certain templates. Attacks can be...
CVE-2018-18579
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...
Cross site scripting
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...
Cross site scripting
DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...
CVE-2018-18578
DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...
CVE-2018-18578
DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...
CVE-2018-18579
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...