DedeCMS vulnerabilities
We track 33 vulnerabilities in DedeCMS products. 33 are rated high or critical, and none are known to be exploited. The most recent was published on October 26, 2026.
Latest DedeCMS vulnerabilities
- 7.3 High severity
DedeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code inject
- 7.3 High severity
DedeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytag_js.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public
- 7.3 High severity
DeDeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has be
- 7.3 High severity
DedeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulation of the argument postname/des results in sql injection. The attack may be launched remotely. The exploit has been rel
- 7.3 High severity
DedeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dede_htmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly
- 7.3 High severity
DedeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched
- 8.8 High severity
DedeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation of the argument orderby leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly a
- 7.2 High severity
DedeCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical. This issue affects some unknown processing of the file /include/dedetag.class.php of the component Template Handler. The manipulation of the argument notes leads to command injection.
- 7.2 High severity
DedeCMS: Improper Control of Generation of Code
A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sys_verifies.php?action=getfiles of the component Incomplete Fix CVE-2018-9175. The manipulation of the argument refiles leads to
- 9.8 Critical severity
DedeCMS: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/friendlink_add.php. The manipulation of the argument logoimg leads to unrestricted upload. It is possible to initiate the a
- 8.8 High severity
DedeCMS: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in DedeCMS up to 5.7.115. It has been rated as critical. This issue affects some unknown processing of the file /dede/article_string_mix.php. The manipulation leads to os command injection. The attack may be initiated remotely. The ex
- 7.2 High severity
DedeCMS: Improper Control of Generation of Code
A vulnerability was found in DedeCMS 5.7.114. It has been classified as critical. This affects an unknown part of the file article_template_rand.php. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been
- 9.8 Critical severity
dedecms: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted file.
- 7.5 High severity
DedeCMS: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability classified as problematic has been found in DedeCMS 5.7.114. This affects an unknown part of the file /sys_verifies.php?action=view. The manipulation of the argument filename with the input ../../../../../etc/passwd leads to path traversal: '..
- 7.5 High severity
DedeCMS: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in DedeCMS 5.7.112-UTF8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file update_guide.php. The manipulation of the argument files leads to path traversal: '../filedir'. The att
- 9.8 Critical severity
DedeCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in DedeCMS 5.7.112-UTF8. Affected is an unknown function of the file stepselect_main.php. The manipulation of the argument ids leads to sql injection. It is possible to launch the attack remotely. Th
- 8.8 High severity
DedeCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file dede/makehtml_archives_action.php. The manipulation leads to sql injection. The attack may be initiated remotely. The e
- 9.8 Critical severity
dedecms: Cross-Site Request Forgery
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execute arbitrary code.
- 9.8 Critical severity
DeDeCMS: Unrestricted Upload of File with Dangerous Type
A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112. Affected is an unknown function of the file file_class.php of the component Backend. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. Th
- 8.8 High severity
dedecms: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form.
- 8.8 High severity
DedeCMS: Improper Neutralization of Special Elements used in an OS Command
A vulnerability classified as critical was found in DedeCMS 5.7.111. This vulnerability affects the function AddMyAddon of the file album_add.php. The manipulation of the argument albumUploadFiles leads to os command injection. The attack can be initiated remo
- 8.8 High severity
Dedecms: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.
- 8.8 High severity
DedeCMS: Absolute Path Traversal
A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_templets_post.php. The manipulation of the argument activepath leads to absolute p
- 9.8 Critical severity
DedeCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in DedeCMS 5.7.110. This vulnerability affects unknown code of the file /uploads/tags.php. The manipulation of the argument tag_alias leads to sql injection. The attack can be initiated remotely. The exploit has
- 9.8 Critical severity
Dedecms: Improper Control of Generation of Code
Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php.
- 9.8 Critical severity
Dedecms: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- 9.8 Critical severity
DedeCMS: Server-Side Request Forgery
A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed
- 8.8 High severity
DedeCMS: Improper Control of Generation of Code
A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file uploads/dede/article_allowurl_edit.php. The manipulation of the argument allurls leads to code injectio
- 8.8 High severity
DedeCMS: Unrestricted Upload of File with Dangerous Type
A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/config.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The ex
- 9.8 Critical severity
DedeCMS: Improper Control of Generation of Code
A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical. This issue affects the function GetSystemFile of the file module_main.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclo
- 7.2 High severity
Dedecms: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dedestory_catalog.php endpoint.
- 7.2 High severity
Dedecms: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php endpoint.
- 8.8 High severity
Dedecms: Cross-Site Request Forgery
DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords.