CVE-2020-18917

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control...

CVE-2018-18578

DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter...