CVE-2017-17730

DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...

Design/Logic Flaw

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...

Sql injection

DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...

CVE-2017-17731

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...

Sql injection

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...

CVE-2017-17727

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...

CVE-2017-17730

DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...

CVE-2017-17731

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...

CVE-2017-17727

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...

CVE-2017-17730

DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flinkadd.php...

CVE-2017-17727

CVE-2017-17727 affects DedeCMS 5.6 and earlier. Affected component: template handling in member/article_edit.php; root cause: insufficient validation in the templet parameter allows embedding PHP code within a .jpg file, enabling arbitrary file upload and PHP code execution. Documented impact: re...

CVE-2017-17731

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php...

CVE-2017-17730

DedeCMS ≤ 5.7 is affected by a SQL Injection vulnerability in the logo parameter of plus/flink_add.php. The issue stems from unsanitized input in that parameter, enabling potential SQL injection. Severity is reflected in CVE data (NVD: high/critical depending on metric). No explicit remediation o...

CVE-2017-17731

DedeCMS versions through 5.7 are vulnerable to SQL Injection due to improper neutralization of special elements in the $_FILES superglobal, specifically affecting the plus/recommend.php component. A remote attacker can exploit this flaw to execute arbitrary SQL commands, potentially resulting in ...

PT-2017-14973

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7 Description The issue is related to SQL injection. It can be exploited via the $ FILES superglobal in the "plus/recommend.php" endpoint. Recommendations For DedeCMS versions prior to 5.7, update to version 5.7 or...

Desdev DedeCMS SQL Injection Vulnerability (CNVD-2018-01088)

Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...

CVE-2017-17727: Unrestricted Upload of File with Dangerous Type

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/articleedit.php...

PT-2017-14971

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7 Description The issue allows for arbitrary file upload and PHP code execution. This can be achieved by embedding PHP code in a .jpg file and using it in the templet parameter to the "member/article edit.php"...

PT-2017-14972

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7 Description The issue allows for SQL Injection via the logo parameter to the "plus/flink add.php" endpoint. Recommendations For versions prior to 5.7, update to version 5.7 or later to resolve the issue...

Desdev DedeCMS SQL Injection Vulnerability

Desdev DedeCMS Dream Weaving Content Management System is China's Zhuozhuo network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. A SQL injection vulnerability exis...