Priority HIGH 77
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to requ…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00553 · Published 2026-10-30 · Fixed in 5.7 CWE-98
Priority HIGH 81
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00441 · Published 2026-10-22 · No fix listed CWE-94
Priority LOW 23
DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter.
CVSS 4.0MEDIUM 5.1· Network · No auth · User interaction · EPSS 0.00264 · Published 2026-10-20 · No fix listed CWE-79
Priority HIGH 82
An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00579 · Published 2026-04-01 · No fix listed CWE-94
Priority LOW 39
DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00143 · Published 2026-03-24 · No fix listed CWE-352
Priority HIGH 82
An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00722 · Published 2026-03-19 · No fix listed CWE-94
Priority HIGH 73
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00215 · Published 2025-12-29 · No fix listed CWE-352
Priority MEDIUM 57
A vulnerability was identified in DedeCMS up to 5.7.118.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00351 · Published 2025-12-22 · No fix listed CWE-74
Priority MEDIUM 56
A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.06594 · Published 2025-06-20 · No fix listed CWE-74
Priority MEDIUM 56
A vulnerability was found in DedeCMS 5.7.117.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00609 · Published 2025-05-25 · No fix listed CWE-74
Priority HIGH 68
Dedecms 5.71sp1 and earlier is vulnerable to URL redirect.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01157 · Published 2025-02-11 · No fix listed CWE-601
Priority MEDIUM 57
A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00436 · Published 2024-12-04 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.116.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00413 · Published 2024-12-04 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability classified as problematic was found in DedeCMS 5.7.116.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00413 · Published 2024-12-04 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability classified as problematic has been found in DedeCMS 5.7.116.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00452 · Published 2024-12-04 · No fix listed CWE-79
Priority MEDIUM 56
A vulnerability classified as problematic has been found in DedeCMS 5.7.116.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.02606 · Published 2024-11-12 · No fix listed CWE-284
Priority MEDIUM 56
A vulnerability was found in DedeCMS up to 5.7.115.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.20799 · Published 2024-09-22 · No fix listed CWE-77
Priority MEDIUM 41
Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00521 · Published 2024-09-18 · No fix listed CWE-434
Priority LOW 27
DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00282 · Published 2024-09-18 · No fix listed CWE-79
Priority HIGH 67
DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0086 · Published 2024-08-23 · No fix listed CWE-77
Priority MEDIUM 56
A vulnerability was found in DedeCMS 5.7.114.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00667 · Published 2024-07-21 · No fix listed CWE-94
Priority MEDIUM 50
An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00729 · Published 2024-05-28 · No fix listed CWE-434
Priority MEDIUM 49
There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00469 · Published 2024-05-23 · No fix listed CWE-434
Priority MEDIUM 58
DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys_data_replace.php.
CVSS 3.1MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.00283 · Published 2024-05-17 · No fix listed CWE-79
Priority LOW 26
A vulnerability classified as problematic has been found in DedeCMS 5.7.114.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.01133 · Published 2024-05-11 · No fix listed CWE-24
Load more
THREATIST.IORead the docs