Browse CVEs

CRITICAL 9.8 CVE-2018-19061 DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter. Dedecms No fix yet Fix from $2,3002018-11-07 MEDIUM 6.1 CVE-2018-18781 DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter. Dedecms No fix yet Fix from $1,6002018-10-29 MEDIUM 6.1 CVE-2018-18782 Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter. Dedecms No fix yet Fix from $1,6002018-10-29 MEDIUM 6.1 CVE-2018-18608 DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbe… Dedecms No fix yet Fix from $1,6002018-10-23 MEDIUM 6.1 CVE-2018-18578 DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter. Dedecms No fix yet Fix from $1,6002018-10-22 MEDIUM 6.1 CVE-2018-18579 Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter. Dedecms No fix yet Fix from $1,6002018-10-22 HIGH 7.2 CVE-2018-16784 DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring. Dedecms No fix yet Fix from $1,9502018-09-21 MEDIUM 6.1 CVE-2018-16786 DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php. Dedecms No fix yet Fix from $1,6002018-09-21 HIGH 8.8 CVE-2018-16785 XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshe… Dedecms No fix yet Fix from $1,9502018-09-19 CRITICAL 9.8 CVE-2018-12045 DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfi… Dedecms 5.7+ Fix from $2,3002018-06-08 HIGH 7.5 CVE-2018-12046 DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with name and… Dedecms 5.7+ Fix from $1,9502018-06-08 CRITICAL 9.8 CVE-2018-10375 A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and exe… Dedecms Mitigation only Fix from $2,3002018-04-25 CRITICAL 9.8 CVE-2018-9174 sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modify… Dedecms Mitigation only Fix from $2,3002018-04-02 CRITICAL 9.8 CVE-2018-9175 DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within th… Dedecms Mitigation only Fix from $2,3002018-04-02 HIGH 8.8 CVE-2018-9134 file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .ph… Dedecms Mitigation only Fix from $1,9502018-03-30 HIGH 8.8 CVE-2018-7700EPSS 75% DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp… Dedecms No fix yet Fix from $1,9502018-03-27 HIGH 7.5 CVE-2018-6910EPSS 19% DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php. Dedecms No fix yet Fix from $1,9502018-02-13 MEDIUM 5.3 CVE-2018-6881 EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php. Dedecms No fix yet Fix from $1,6002018-02-12 CRITICAL 9.8 CVE-2017-17730 DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php. Dedecms after 5.7 Fix from $2,3002017-12-18 CRITICAL 9.8 CVE-2017-17731EPSS 13% DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php. Dedecms after 5.7 Fix from $2,3002017-12-18 HIGH 8.8 CVE-2017-17727 DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parame… Dedecms after 5.6 Fix from $1,9502017-12-18 HIGH 7.5 CVE-2011-5200 Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1)… Dedecms No fix yet Fix from $1,9502012-09-23 MEDIUM 6.8 CVE-2010-1097 include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain adminis… Dedecms No fix yet Fix from $1,6002010-03-24 HIGH 7.5 CVE-2009-3806 SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter. Dedecms Mitigation only Fix from $1,9502009-10-27 MEDIUM 6.8 CVE-2009-2270 Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a fil… Dedecms Mitigation only Fix from $1,6002009-07-01