CVE-2021-48016

DedeCMS (through version 5.8.1-beta ) is vulnerable to a PHP code injection vulnerability within the ShowMsg() function. The flaw exists because the HTTP Referer header is written into a DedeTemplate string and subsequently included by the application. Unauthenticated attackers can exploit this b...

DedeCMS flink.php RCE

Exploits DedeCMS 5.8.1-beta variable override via Referer header injection on /plus/flink.php with the c query parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """DedeCMS 5.8.1-beta flink.php variable override RCE — execute session.""" from future import...

CVE-2026-10607

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dedehtmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-10607 DedeCMS flink.php dede_htmlspecialchars sql injection

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dedehtmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-10607: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dedehtmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used...

DesDev DedeCMS SQL Injection Vulnerability

DesDev DedeCMS is an open-source content management system CMS developed by DesDev Corporation, based on PHP. This system offers functions such as content publishing, content management, content editing, and content retrieval. Version 5.7.88 of DesDev DedeCMS contains a SQL injection vulnerabilit...

PT-2026-45818

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7.88 Description A remote SQL injection is possible through the manipulation of the msg argument within the dede htmlspecialchars function located in the '/plus/flink.php' file. Recommendations As a temporary workaround,...