CVE-2020-18184

Removed by vendor...

Design/Logic Flaw

An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/selectimagespost.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the...

CVE-2018-20129

Summary: CVE-2018-20129 affects DedeCMS v5.7 SP2 in uploads/include/dialog/select_images_post.php, enabling uploaded PHP code execution via a crafted filename using a double extension and manipulated ".php" substring, in conjunction with image/jpeg content type. The vulnerability mechanism is a f...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

Design/Logic Flaw

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-16785

XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell...

CVE-2018-10375

A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archivesdo.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename...

Dedecms V5.7后台的两处getshell(CVE-2018-9175)

第一个是常见的思路，把语句写入inc文件，然后在其他的include语句中，包含了恶意代码进而getshell。 漏洞代码在:/dede/sysverifies.php 代码如下： else if $action == 'getfiles' if!isset$refiles ShowMsg"你没进行任何操作！","sysverifies.php"; exit; $cacheFiles = DEDEDATA.'/modifytmp.inc'; $fp = fopen$cacheFiles, 'w'; fwrite$fp, ''; fclose$fp; $dirinfos = ''; if$...

Dedecms V5.7 Backend Co_add.php File Exists SQL Injection Vulnerability

DedeCMS is a PHP open source website management system. A SQL injection vulnerability exists in the Coadd.php file in the backend of Dedecms V5.7. Attackers can use the vulnerability to obtain sensitive information in the database...

dedecms v5.7缓存文件data/cache/typename.inc导致任意代码执行（有条件）

No description provided by source...

DEDECMS v5. 7(2013-06-07) xss+csrf 0day-vulnerability warning-the black bar safety net

Bookmark management existxss+csrf http://localhost/dedecms/member/flinkmain.php xss:http://localhost/dedecms/member/flinkmain.php?dopost=addnew&title=test' onmouseover=alert1;'&url=test' onmouseover=alert1;' CSRF:img...

Dedecms v5.7 plus\feedback.php SQL注入漏洞

No description provided by source...

DedeCMS V5.7 SP1 UTF-8 GBK版本shopcar.class.php被植入后门

No description provided by source...

How to get the nworksDEMO tool v5.7

Purpose You need to get nworksDEMO tool v5.7 to see nworks MP in action and be able to use it for offline demonstrations and training. Solution Browse to the nworksDEMO tool v5.7 landing page and submit your request using the online form: http://go.veeam.com/nworksdemo More Information If you hav...

Woven dream CMS system - visitors unlimited brush the top step on the value-vulnerability warning-the black bar safety net

Brief description: only tested DEDECMS V5. 7 system,the previous version of the estimates is the same. In the official address to be a simple test,should be regarded as a small BUG,using this you can infinite brush an article of the top/tread value. Detailed description: although the front page d...

dns-pro.dos.txt

Remote D.o.S Attack in DNS PRO v5.7 WinNT From FBLI Software Vulnerability USSR Advisory Code: 22 Release Date: December 21, 1999 Systems Affected: DNS PRO v5.7 and possibly others. About The Software: The first DNS Server for Windows NT - Database engine five time faster. - Tabs now work in the...