DedeCMS - Open Redirect via download.php

Dedecms 5.71sp1 and earlier contain a URL redirect caused by a logic error that does not properly validate GET request input, letting attackers redirect users to arbitrary URLs, exploit requires sending crafted GET requests. id: CVE-2024-57241 info: name: DedeCMS - Open Redirect via download.php...

DedeCMS 5.7 - SQL Injection

DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php. id: CVE-2017-17731 info: name: DedeCMS 5.7 - SQL Injection author: j4vaovo severity: critical description: | DedeCMS through 5.7 has SQL Injection via the $FILES superglobal to plus/recommend.php. impact: |...

DedeCMS 5.7 SP2 - Cross-Site Scripting

DedeCMS 5.7 SP2 is vulnerable to cross-site scripting via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php,...

DedeCMS 5.7.109 - Server-Side Request Forgery

Manipulation of the rssurl parameter in codo.php leads to server-side request forgery in DedeCMS version 5.7.109. id: CVE-2023-3578 info: name: DedeCMS 5.7.109 - Server-Side Request Forgery author: ritikchaddha severity: critical description: | Manipulation of the rssurl parameter in codo.php lea...

DedeCMS 5.7.87 - Directory Traversal

Directory traversal vulnerability in DedeCMS 5.7.87 allows reading sensitive files via the $activepath parameter. id: CVE-2023-2059 info: name: DedeCMS 5.7.87 - Directory Traversal author: pussycat0x severity: medium description: | Directory traversal vulnerability in DedeCMS 5.7.87 allows readin...

DedeCMS 5.7 - Path Disclosure

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php id: CVE-2018-6910 info: name: DedeCMS 5.7 - Path Disclosure author: pikpikcu severity: high description: DedeCMS 5.7 allows remote attackers to discover t...

DedeCMS v5.7.111 - Cross-Site Scripting

DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting XSS vulnerability via the component selectmediapostwangEditor.php. id: CVE-2023-49494 info: name: DedeCMS v5.7.111 - Cross-Site Scripting author: ritikchaddha severity: medium description: | DedeCMS v5.7.111 was discover...

CVE-2025-6335

Título: Vulnerabilidad de ejecución de comandos por inyección de plantillas en dedeCMS 5.7 sp2 BUGAuthor: Ewoji Versión afectada: dedeCMS 5.7.2 Proveedor: Shanghai Zhuozhuo Network Technology Co., LTD Software: dedeCMS Archivos vulnerables: /include/dedetag.class.php Descripción: 1. Después de la...

CVE-2024-57241

CVE-2024-57241CNNVD-2024-34500830 Para aplicaciones web que utilizan DEDECMS 5.71SP1 y anteriores, se producen redirecciones de URL debido a que el error de lógica en el código fuente del CMS no valida la solicitud GET de entrada. En aplicaciones web que usan DEDECMS 5.71SP1 y versiones inferiore...

DedeCMS-getshell-CVE-2023-2928-

This repository does not have a README...

DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution

DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code. id: CVE-2018-7700 info: name: DedeCMS 5.7SP2 - Cross-Site...

CVE-2026-94004

A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytagjs.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used...

CVE-2026-94004 DedeCMS mytag_js.php code injection

A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytagjs.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used...

EUVD-2026-83732

A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytagjs.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used...

CVE-2026-94004

DedeCMS versions up to 5.7.118 are affected by a code injection vulnerability in the file plus/mytag_js.php . The root cause is the manipulation of the aid argument within an unknown function of that file. The vulnerability is exploitable remotely with no privileges and no user interaction requir...

CVE-2026-94004 DedeCMS mytag_js.php code injection

A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytagjs.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used...

CVE-2026-94004: Improper Control of Generation of Code

A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytagjs.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used...

PT-2026-95960

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7.119 Description A remote code injection issue exists in the file plus/mytag js.php. The flaw allows an attacker to execute arbitrary code by manipulating the aid argument within an unknown function of that file...

CVE-2026-76800

A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/selectmediapost.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published...

CVE-2026-76800 DeDeCMS select_media_post.php unrestricted upload

A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/selectmediapost.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published...