DedeCMS

Records168All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical29CVSS 9.0–10.0

CVSS high48CVSS 7.0–8.9

Exploited now

DedeCMS records in CISA KEV

No DedeCMS vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Dedecms 165 records HIGH

Records

165 records in Dedecms · all components

TI-2026-23605 CVE-2026-30694 · GHSA-6f7w-7xmx-mx54

An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary…

HIGH 82

An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00722 Published 2026-03-19 No fix listed CWE-94

TI-2026-23594 CVE-2026-30643 · GHSA-vc3q-w6jg-xcpj

An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted…

HIGH 82

An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00579 Published 2026-04-01 No fix listed CWE-94

TI-2024-19496 CVE-2024-29684 · GHSA-gwqv-mxv2-3769

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the…

HIGH 82

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execute arbitrary code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00571 Published 2024-03-26 No fix listed CWE-352

TI-2024-19491 CVE-2024-29661 · GHSA-chxx-2hqp-fv9f

A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.

HIGH 82

A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00674 Published 2024-04-22 No fix listed CWE-434

TI-2018-05549 CVE-2018-7700 · GHSA-r537-6cxx-h2mh

DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode…

HIGH 77

DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.74118 Published 2018-03-27 No fix listed CWE-352

TI-2024-03438 CVE-2024-3685 · GHSA-3f72-8h82-c28p

DedeCMS stepselect_main.php sql injection

HIGH 75

A vulnerability, which was classified as critical, was found in DedeCMS 5.7.112-UTF8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00586 Published 2024-04-12 No fix listed CWE-89

TI-2023-01933 CVE-2023-2056 · GHSA-w6jq-fpcp-h5cr

DedeCMS module_main.php GetSystemFile code injection

HIGH 75

A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00966 Published 2023-04-14 No fix listed CWE-94

TI-2024-20414 CVE-2024-30965 · GHSA-wq73-4j39-6948

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability…

HIGH 73

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00365 Published 2024-04-02 No fix listed CWE-352

TI-2024-20361 CVE-2024-30855 · GHSA-q38m-7hwc-v39w

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability…

HIGH 73

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00215 Published 2025-12-29 No fix listed CWE-352

TI-2024-18953 CVE-2024-28684 · GHSA-33pj-qgph-f4cq

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability…

HIGH 73

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.php

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00323 Published 2024-03-13 No fix listed CWE-352

TI-2024-18944 CVE-2024-28675 · GHSA-hmmj-whc7-2qjg

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php

HIGH 73

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00316 Published 2024-03-13 No fix listed CWE-352

TI-2024-18943 CVE-2024-28673 · GHSA-j898-65ww-gjr4

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php.

HIGH 73

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00371 Published 2024-03-13 No fix listed CWE-352

TI-2024-18941 CVE-2024-28671 · GHSA-mqm2-88x2-f63v

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect_main.php.

HIGH 73

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect_main.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00876 Published 2024-03-13 No fix listed CWE-79

TI-2024-18935 CVE-2024-28665 · GHSA-vppw-rwg5-66qv

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability…

HIGH 73

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_add.php

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00323 Published 2024-03-13 No fix listed CWE-352

TI-2024-18875 CVE-2024-28432 · GHSA-4fx8-vqcc-fc22

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability…

HIGH 73

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00347 Published 2024-03-13 No fix listed CWE-352

TI-2024-18874 CVE-2024-28431 · GHSA-wj9m-j983-c5jg

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability…

HIGH 73

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00332 Published 2024-03-13 No fix listed CWE-352

TI-2023-23168 CVE-2023-43275 · GHSA-9cgv-2g5m-v85j

Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management…

HIGH 73

Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of t…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00323 Published 2023-11-16 No fix listed CWE-352

TI-2023-23143 CVE-2023-43226 · GHSA-pv73-7cqr-xg4v

An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and…

HIGH 73

An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00947 Published 2023-09-28 No fix listed CWE-434

TI-2023-14254 CVE-2023-30380 · GHSA-rrh7-8r24-9h46

An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers…

HIGH 72

An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01223 Published 2023-04-27 No fix listed CWE-22

TI-2023-04876 CVE-2023-5301 · GHSA-5v83-9jw8-hpvg

DedeCMS album_add.php AddMyAddon os command injection

HIGH 71

A vulnerability classified as critical was found in DedeCMS 5.7.111.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.07462 Published 2023-09-30 No fix listed CWE-78

TI-2015-03830 CVE-2015-4553 · GHSA-pqqv-cppc-qv6m

A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.

HIGH 71

A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.56738 Published 2020-01-06 No fix listed CWE-434

TI-2023-02744 CVE-2023-2928 · GHSA-m47h-qxcc-5fhx

DedeCMS article_allowurl_edit.php code injection

HIGH 70

A vulnerability was found in DedeCMS up to 5.7.106.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.51351 Published 2023-05-27 No fix listed CWE-94

TI-2024-37841 CVE-2024-57241 · GHSA-6vpc-jmr8-rh6f

Dedecms 5.71sp1 and earlier is vulnerable to URL redirect.

HIGH 68

Dedecms 5.71sp1 and earlier is vulnerable to URL redirect.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01157 Published 2025-02-11 No fix listed CWE-601

TI-2024-28556 CVE-2024-42636 · GHSA-6v83-ppjw-wp84

DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.

HIGH 67

DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0086 Published 2024-08-23 No fix listed CWE-77

TI-2023-12381 CVE-2023-27733 · GHSA-7r5m-2rp9-gxvf

DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.

HIGH 67

DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00791 Published 2023-04-17 No fix listed CWE-89

Open these records in search →