Dedecms
Page 2 of 2 — Dedecms CVEs from a corpus of 165, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-30380 | High | 7.5 | 2023-04-27 | An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal. |
CVE-2023-27733 | High | 7.2 | 2023-04-17 | DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php. |
CVE-2023-2059 | Medium | 4.3 | 2023-04-14 | A vulnerability was found in DedeCMS 5.7.87. It has been rated as problematic. Affected by this issue is some unknown functionality of the file uploads/include… |
CVE-2023-2056 | Medium | 6.3 | 2023-04-14 | A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical. This issue affects the function GetSystemFile of the file module_main.php. The ma… |
CVE-2023-27709 | High | 7.2 | 2023-03-16 | SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dedestory_catalog.ph… |
CVE-2023-27707 | High | 7.2 | 2023-03-16 | SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php… |
CVE-2022-48140 | Medium | 5.4 | 2023-02-02 | DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename. |
CVE-2022-46442 | Critical | 9.8 | 2022-12-27 | dedecms <=V5.7.102 is vulnerable to SQL Injection. In sys_ sql_ n query.php there are no restrictions on the sql query. |
CVE-2022-43192 | Medium | 6.7 | 2022-11-17 | An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a craf… |
CVE-2022-43031 | High | 8.8 | 2022-11-09 | DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin… |
CVE-2022-40921 | High | 7.2 | 2022-10-12 | DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php. |
CVE-2022-40886 | High | 7.2 | 2022-10-03 | DedeCMS 5.7.98 has a file upload vulnerability in the background. |
CVE-2022-36583 | Medium | 6.1 | 2022-09-01 | DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/co_do.php via the dopost, rpok, and aid parameters. |
CVE-2022-36216 | High | 7.2 | 2022-08-17 | DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php. |
CVE-2022-35516 | Critical | 9.8 | 2022-08-17 | DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php. |
CVE-2022-34531 | Critical | 9.8 | 2022-07-29 | DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php. |
CVE-2022-30508 | Medium | 6.5 | 2022-05-26 | DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter. |
CVE-2022-23337 | Critical | 9.8 | 2022-02-14 | DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter. |
CVE-2020-36497 | Medium | 6.1 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`… |
CVE-2020-36496 | Medium | 6.1 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component sys_admin_user_edit.php via the `filename`, `mi… |
CVE-2020-36495 | Medium | 6.1 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `filename`, `mid`… |
CVE-2020-36494 | Medium | 6.1 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component mychannel_edit.php via the `filename`, `mid`, `… |
CVE-2020-36493 | Medium | 5.4 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component media_main.php via the `activepath`, `keyword`… |
CVE-2020-36492 | Medium | 5.4 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component select_media.php via the `activepath`, `keyword… |
CVE-2020-36491 | Medium | 5.4 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tags_main.php via the `activepath`, `keyword`… |
CVE-2020-36490 | Medium | 5.4 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `activepath`, `key… |
CVE-2020-23046 | Medium | 6.1 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`, `mid`, `userid`, an… |
CVE-2020-23044 | Medium | 5.4 | 2021-10-22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic_view.php via the `activepath`, `keywor… |
CVE-2020-18114 | Critical | 9.8 | 2021-08-27 | An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format. |
CVE-2020-18917 | High | 8.8 | 2021-08-24 | The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typen… |
CVE-2020-22198 | Critical | 9.8 | 2021-06-16 | SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php. |
CVE-2021-32073 | High | 8.8 | 2021-05-15 | DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution. |
CVE-2020-16632 | Medium | 5.4 | 2021-05-15 | A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parame… |
CVE-2020-27533 | Medium | 5.4 | 2020-10-22 | A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other u… |
CVE-2015-4553 | High | 8.8 | 2020-01-06 | A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. |
CVE-2019-10014 | Medium | 6.5 | 2019-03-24 | In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because th… |
CVE-2019-8933 | High | 8.8 | 2019-02-19 | In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this fi… |
CVE-2019-8362 | High | 7.5 | 2019-02-16 | DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip… |
CVE-2019-6289 | High | 8.8 | 2019-01-15 | uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension an… |
CVE-2018-20129 | High | 8.8 | 2018-12-13 | An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via… |
CVE-2018-19061 | Critical | 9.8 | 2018-11-07 | DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter. |
CVE-2018-18782 | Medium | 6.1 | 2018-10-29 | Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter. |
CVE-2018-18781 | Medium | 6.1 | 2018-10-29 | DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter. |
CVE-2018-18608 | Medium | 6.1 | 2018-10-23 | DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at… |
CVE-2018-18579 | Medium | 6.1 | 2018-10-22 | Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter. |
CVE-2018-18578 | Medium | 6.1 | 2018-10-22 | DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter. |
CVE-2018-16786 | Medium | 6.1 | 2018-09-21 | DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php. |
CVE-2018-16784 | High | 7.2 | 2018-09-21 | DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring. |
CVE-2018-16785 | High | 8.8 | 2018-09-19 | XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell |
CVE-2018-12046 | High | 7.5 | 2018-06-08 | DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with name and str param… |
CVE-2018-12045 | Critical | 9.8 | 2018-06-08 | DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfile1 parame… |
CVE-2018-10375 | Critical | 9.8 | 2018-04-25 | A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbit… |
CVE-2018-9175 | Critical | 9.8 | 2018-04-02 | DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database… |
CVE-2018-9174 | Critical | 9.8 | 2018-04-02 | sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc ar… |
CVE-2018-9134 | High | 8.8 | 2018-03-30 | file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file und… |
CVE-2018-7700 | High | 8.8 | 2018-03-27 | DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in… |
CVE-2018-6910 | High | 7.5 | 2018-02-13 | DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php. |
CVE-2018-6881 | Medium | 5.3 | 2018-02-12 | EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php. |
CVE-2017-17731 | Critical | 9.8 | 2017-12-18 | DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php. |
CVE-2017-17730 | Critical | 9.8 | 2017-12-18 | DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php. |
CVE-2017-17727 | High | 8.8 | 2017-12-18 | DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to mem… |
CVE-2011-5200 | | 2012-09-23 | Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) list.php… | |
CVE-2010-1097 | | 2010-03-24 | include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative ac… | |
CVE-2009-3806 | | 2009-10-27 | SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter. | |
CVE-2009-2270 | | 2009-07-01 | Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a file with a d… |