CVE-2021-48016

DedeCMS through version 5.8.1-beta is vulnerable to a PHP code injection vulnerability within the ShowMsg() function. The root cause is that the HTTP Referer header is improperly written into a DedeTemplate string and subsequently included by the application. Unauthenticated attackers can exploit...