ky-j/dedecms

GitHub

github.com

Releases0

Stars5

自定制dedecms

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2020-16632 ↗	May 15, 2021Saturday, 15 May 2021, 00:15	5.4 MEDIUM	3.5 LOW
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073 ↗	May 15, 2021Saturday, 15 May 2021, 00:15	8.8 HIGH	6.8 MEDIUM
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2018-18781 ↗	Oct 29, 2018Monday, 29 October 2018, 12:29	—	4.3 MEDIUM
DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.
CVE-2018-18782 ↗	Oct 29, 2018Monday, 29 October 2018, 12:29	—	4.3 MEDIUM
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.
CVE-2018-18608 ↗	Oct 23, 2018Tuesday, 23 October 2018, 18:29	—	4.3 MEDIUM
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php.
CVE-2018-18578 ↗	Oct 22, 2018Monday, 22 October 2018, 21:29	—	4.3 MEDIUM
DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter.
CVE-2018-18579 ↗	Oct 22, 2018Monday, 22 October 2018, 21:29	—	4.3 MEDIUM
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter.
CVE-2018-16784 ↗	Sep 21, 2018Friday, 21 September 2018, 15:29	—	6.5 MEDIUM
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.
CVE-2018-16786 ↗	Sep 21, 2018Friday, 21 September 2018, 15:29	—	4.3 MEDIUM
DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php.
CVE-2018-16785 ↗	Sep 19, 2018Wednesday, 19 September 2018, 15:29	—	6.5 MEDIUM
XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell
CVE-2018-10375 ↗	Apr 25, 2018Wednesday, 25 April 2018, 09:29	—	7.5 HIGH
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename ends in .php and contains PHP code.