Browse CVEs

HIGH 8.8 CVE-2019-8933 In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execu… Dedecms No fix yet Fix from $1,9502019-02-19 HIGH 8.8 CVE-2019-6289 uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file ex… Dedecms Mitigation only Fix from $1,9502019-01-15 HIGH 8.8 CVE-2018-20129EPSS 8% An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PH… Dedecms No fix yet Fix from $1,9502018-12-13 CRITICAL 9.8 CVE-2018-19061 DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter. Dedecms No fix yet Fix from $2,3002018-11-07 MEDIUM 6.1 CVE-2018-18781 DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter. Dedecms No fix yet Fix from $1,6002018-10-29 MEDIUM 6.1 CVE-2018-18782 Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter. Dedecms No fix yet Fix from $1,6002018-10-29 MEDIUM 6.1 CVE-2018-18608 DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbe… Dedecms No fix yet Fix from $1,6002018-10-23 MEDIUM 6.1 CVE-2018-18578 DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter. Dedecms No fix yet Fix from $1,6002018-10-22 MEDIUM 6.1 CVE-2018-18579 Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter. Dedecms No fix yet Fix from $1,6002018-10-22 HIGH 7.2 CVE-2018-16784 DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring. Dedecms No fix yet Fix from $1,9502018-09-21 MEDIUM 6.1 CVE-2018-16786 DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php. Dedecms No fix yet Fix from $1,6002018-09-21 HIGH 8.8 CVE-2018-16785 XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshe… Dedecms No fix yet Fix from $1,9502018-09-19 CRITICAL 9.8 CVE-2018-10375 A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and exe… Dedecms Mitigation only Fix from $2,3002018-04-25 CRITICAL 9.8 CVE-2018-9174 sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modify… Dedecms Mitigation only Fix from $2,3002018-04-02 CRITICAL 9.8 CVE-2018-9175 DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within th… Dedecms Mitigation only Fix from $2,3002018-04-02 HIGH 8.8 CVE-2018-9134 file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .ph… Dedecms Mitigation only Fix from $1,9502018-03-30 HIGH 8.8 CVE-2018-7700EPSS 75% DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp… Dedecms No fix yet Fix from $1,9502018-03-27 HIGH 7.5 CVE-2018-6910EPSS 19% DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php. Dedecms No fix yet Fix from $1,9502018-02-13 MEDIUM 5.3 CVE-2018-6881 EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php. Dedecms No fix yet Fix from $1,6002018-02-12 HIGH 7.5 CVE-2011-5200 Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1)… Dedecms No fix yet Fix from $1,9502012-09-23 MEDIUM 6.8 CVE-2010-1097 include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain adminis… Dedecms No fix yet Fix from $1,6002010-03-24 HIGH 7.5 CVE-2009-3806 SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter. Dedecms Mitigation only Fix from $1,9502009-10-27 MEDIUM 6.8 CVE-2009-2270 Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a fil… Dedecms Mitigation only Fix from $1,6002009-07-01