Filtered by vendor Dedecms
Subscriptions
Total
88 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-36497 | 1 Dedecms | 1 Dedecms | 2021-10-26 | 6.1 Medium |
| DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`, `userid`, and `templet' parameters. | ||||
| CVE-2020-36496 | 1 Dedecms | 1 Dedecms | 2021-10-26 | 6.1 Medium |
| DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component sys_admin_user_edit.php via the `filename`, `mid`, `userid`, and `templet' parameters. | ||||
| CVE-2020-36495 | 1 Dedecms | 1 Dedecms | 2021-10-26 | 6.1 Medium |
| DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `filename`, `mid`, `userid`, and `templet' parameters. | ||||
| CVE-2020-18114 | 1 Dedecms | 1 Dedecms | 2021-09-01 | 9.8 Critical |
| An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format. | ||||
| CVE-2020-18917 | 1 Dedecms | 1 Dedecms | 2021-08-30 | 8.8 High |
| The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control. | ||||
| CVE-2019-6289 | 1 Dedecms | 1 Dedecms | 2021-07-21 | N/A |
| uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrated by the 1.pHP filename. | ||||
| CVE-2020-22198 | 1 Dedecms | 1 Dedecms | 2021-06-21 | 9.8 Critical |
| SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php. | ||||
| CVE-2021-32073 | 1 Dedecms | 1 Dedecms | 2021-05-21 | 8.8 High |
| DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution. | ||||
| CVE-2020-16632 | 1 Dedecms | 1 Dedecms | 2021-05-21 | 5.4 Medium |
| A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter. | ||||
| CVE-2019-10014 | 1 Dedecms | 1 Dedecms | 2020-08-24 | N/A |
| In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated. | ||||
| CVE-2015-4553 | 1 Dedecms | 1 Dedecms | 2020-01-15 | 8.8 High |
| A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. | ||||
| CVE-2019-8362 | 1 Dedecms | 1 Dedecms | 2019-02-20 | N/A |
| DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" (because input validation only checks that .jpg, .png, or .gif is present as a substring, and does not otherwise check the file name or content). | ||||
| CVE-2018-20129 | 1 Dedecms | 1 Dedecms | 2019-02-05 | N/A |
| An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the filename=1.jpg.p*hp value. | ||||
| CVE-2018-16785 | 1 Dedecms | 1 Dedecms | 2019-01-28 | N/A |
| XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell | ||||
| CVE-2018-18781 | 1 Dedecms | 1 Dedecms | 2018-12-03 | N/A |
| DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter. | ||||
| CVE-2018-18782 | 1 Dedecms | 1 Dedecms | 2018-12-03 | N/A |
| Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter. | ||||
| CVE-2018-16786 | 1 Dedecms | 1 Dedecms | 2018-11-08 | N/A |
| DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php. | ||||
| CVE-2018-16784 | 1 Dedecms | 1 Dedecms | 2018-11-08 | N/A |
| DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring. | ||||
| CVE-2009-3806 | 1 Dedecms | 1 Dedecms | 2018-10-10 | N/A |
| SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter. | ||||
| CVE-2009-2270 | 1 Dedecms | 1 Dedecms | 2018-10-10 | N/A |
| Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a file with a double extension in the filename, then accessing this file via unspecified vectors, as demonstrated by a .jpg.php filename. | ||||