dedebiz records

31 published records for vendor dedebiz.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 6
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')9
CWE-434 Unrestricted Upload of File with Dangerous Type6
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')6
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')5
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
CWE-94 Improper Control of Generation of Code ('Code Injection')1

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

31 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
53Plan	CVE-2023-31546Proof of concept	Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.dedebiz · dedebiz · CWE-79 pre-auth RCE XSS	Critical9.6	—	49.3%	Dec 13, 2023
40Plan	CVE-2022-44118Proof of concept	dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.dedebiz · dedecmsv6 pre-auth RCE	Critical9.8	—	1.7%	Nov 23, 2022
39Monitor	CVE-2023-43234No exploit	DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_control.php via the $acdedebiz · dedebiz · CWE-94 pre-auth RCE	Critical9.8	—	1.1%	Sep 27, 2023
39Monitor	CVE-2024-52770No exploit	An arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary cdedebiz · dedebiz · CWE-79 pre-auth RCE File upload XSS	Critical9.8	—	0.8%	Nov 20, 2024
39Monitor	CVE-2022-44120No exploit	dedecmdv6 6.1.9 is vulnerable to SQL Injection.dedebiz · dedecmsv6 · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.7%	Nov 23, 2022
36Monitor	CVE-2022-43196No exploit	dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.dedebiz · dedecmsv6 Pre-auth	Critical9.1	—	0.7%	Nov 23, 2022
36Monitor	CVE-2024-52771No exploit	DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view.dedebiz · dedebiz · CWE-22 Pre-auth Path traversal	Critical9.1	—	0.6%	Nov 20, 2024
35Monitor	CVE-2023-5266No exploit	DedeBIZ tags_main.php sql injectiondedebiz · dedebiz · CWE-89 SQL injection	High8.8	—	0.6%	Sep 29, 2023
29Monitor	CVE-2022-36215No exploit	DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.dedebiz · dedecmsv6 RCE	High7.2	—	2.3%	Aug 17, 2022
28Monitor	CVE-2023-7181No exploit	Muyun DedeBIZ Add Attachment unrestricted uploaddedebiz · dedebiz · CWE-434 File upload	High7.2	—	0.8%	Dec 30, 2023
28Monitor	CVE-2024-52769No exploit	An arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code dedebiz · dedebiz · CWE-434 RCE File upload	High7.2	—	0.7%	Nov 20, 2024
28Monitor	CVE-2023-6755No exploit	DedeBIZ content_batchup_action.php sql injectiondedebiz · dedebiz · CWE-89 SQL injection	High7.2	—	0.7%	Dec 13, 2023
28Monitor	CVE-2023-3839No exploit	DedeBIZ sys_sql_query.php sql injectiondedebiz · dedebiz · CWE-89 SQL injection	High7.2	—	0.6%	Jul 22, 2023
28Monitor	CVE-2023-5268No exploit	DedeBIZ makehtml_taglist_action.php sql injectiondedebiz · dedebiz · CWE-89 SQL injection	High7.2	—	0.6%	Sep 29, 2023
28Monitor	CVE-2024-0558No exploit	DedeBIZ makehtml_freelist_action.php sql injectiondedebiz · dedebiz · CWE-89 SQL injection	High7.2	—	0.5%	Jan 15, 2024
24Monitor	CVE-2024-44716No exploit	A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaddedebiz · dedebiz · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.2%	Aug 29, 2024
24Monitor	CVE-2024-44717No exploit	A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloaddedebiz · dedebiz · CWE-79 pre-auth RCE XSS	Medium6.1	—	0.2%	Aug 29, 2024
21Monitor	CVE-2024-7903No exploit	DedeBIZ File Extension media_add.php unrestricted uploaddedebiz · dedebiz · CWE-434 File upload	Medium5.3	—	0.7%	Aug 18, 2024
21Monitor	CVE-2024-7904No exploit	DedeBIZ File Extension file_manage_control.php unrestricted uploaddedebiz · dedebiz · CWE-434 File upload	Medium5.3	—	0.6%	Aug 18, 2024
21Monitor	CVE-2024-7905No exploit	DedeBIZ archives_do.php AdminUpload unrestricted uploaddedebiz · dedebiz · CWE-434 File upload	Medium5.3	—	0.6%	Aug 18, 2024
21Monitor	CVE-2024-7906No exploit	DedeBIZ Attachment Settings select_images_post.php get_mime_type unrestricted uploaddedebiz · dedebiz · CWE-434 File upload	Medium5.3	—	0.4%	Aug 18, 2024
21Monitor	CVE-2024-0557No exploit	DedeBIZ Website Copyright Setting cross site scriptingdedebiz · dedebiz · CWE-79 XSS	Medium5.4	—	0.4%	Jan 15, 2024
21Monitor	CVE-2023-43232No exploit	A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute adedebiz · dedebiz · CWE-79 RCE XSS	Medium5.4	—	0.3%	Sep 27, 2023
19Monitor	CVE-2023-3837No exploit	DedeBIZ sys_sql_query.php cross site scriptingdedebiz · dedebiz · CWE-79 XSS	Medium4.8	—	0.7%	Jul 22, 2023
19Monitor	CVE-2023-4170No exploit	DedeBIZ Article cross site scriptingdedebiz · dedebiz · CWE-79 XSS	Medium4.8	—	0.6%	Aug 5, 2023

CVE-2023-31546
53Plan
Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.
CriticalCVSS 9.6Proof of conceptEPSS 49%
- pre-auth RCE
- XSS
dedebiz · dedebizDec 13, 2023
CVE-2022-44118
40Plan
dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
dedebiz · dedecmsv6Nov 23, 2022
CVE-2023-43234
39Monitor
DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_control.php via the $ac
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
dedebiz · dedebizSep 27, 2023
CVE-2024-52770
39Monitor
An arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary c
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- File upload
- XSS
dedebiz · dedebizNov 20, 2024
CVE-2022-44120
39Monitor
dedecmdv6 6.1.9 is vulnerable to SQL Injection.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
dedebiz · dedecmsv6Nov 23, 2022
CVE-2022-43196
36Monitor
dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
dedebiz · dedecmsv6Nov 23, 2022
CVE-2024-52771
36Monitor
DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
dedebiz · dedebizNov 20, 2024
CVE-2023-5266
35Monitor
DedeBIZ tags_main.php sql injection
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
dedebiz · dedebizSep 29, 2023
CVE-2022-36215
29Monitor
DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.
HighCVSS 7.2No exploitEPSS 2%
- RCE
dedebiz · dedecmsv6Aug 17, 2022
CVE-2023-7181
28Monitor
Muyun DedeBIZ Add Attachment unrestricted upload
HighCVSS 7.2No exploitEPSS 0%
- File upload
dedebiz · dedebizDec 30, 2023
CVE-2024-52769
28Monitor
An arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code
HighCVSS 7.2No exploitEPSS 0%
- RCE
- File upload
dedebiz · dedebizNov 20, 2024
CVE-2023-6755
28Monitor
DedeBIZ content_batchup_action.php sql injection
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
dedebiz · dedebizDec 13, 2023
CVE-2023-3839
28Monitor
DedeBIZ sys_sql_query.php sql injection
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
dedebiz · dedebizJul 22, 2023
CVE-2023-5268
28Monitor
DedeBIZ makehtml_taglist_action.php sql injection
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
dedebiz · dedebizSep 29, 2023
CVE-2024-0558
28Monitor
DedeBIZ makehtml_freelist_action.php sql injection
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
dedebiz · dedebizJan 15, 2024
CVE-2024-44716
24Monitor
A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
MediumCVSS 6.1No exploitEPSS 0%
- pre-auth RCE
- XSS
dedebiz · dedebizAug 29, 2024
CVE-2024-44717
24Monitor
A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
MediumCVSS 6.1No exploitEPSS 0%
- pre-auth RCE
- XSS
dedebiz · dedebizAug 29, 2024
CVE-2024-7903
21Monitor
DedeBIZ File Extension media_add.php unrestricted upload
MediumCVSS 5.3No exploitEPSS 0%
- File upload
dedebiz · dedebizAug 18, 2024
CVE-2024-7904
21Monitor
DedeBIZ File Extension file_manage_control.php unrestricted upload
MediumCVSS 5.3No exploitEPSS 0%
- File upload
dedebiz · dedebizAug 18, 2024
CVE-2024-7905
21Monitor
DedeBIZ archives_do.php AdminUpload unrestricted upload
MediumCVSS 5.3No exploitEPSS 0%
- File upload
dedebiz · dedebizAug 18, 2024
CVE-2024-7906
21Monitor
DedeBIZ Attachment Settings select_images_post.php get_mime_type unrestricted upload
MediumCVSS 5.3No exploitEPSS 0%
- File upload
dedebiz · dedebizAug 18, 2024
CVE-2024-0557
21Monitor
DedeBIZ Website Copyright Setting cross site scripting
MediumCVSS 5.4No exploitEPSS 0%
- XSS
dedebiz · dedebizJan 15, 2024
CVE-2023-43232
21Monitor
A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute a
MediumCVSS 5.4No exploitEPSS 0%
- RCE
- XSS
dedebiz · dedebizSep 27, 2023
CVE-2023-3837
19Monitor
DedeBIZ sys_sql_query.php cross site scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
dedebiz · dedebizJul 22, 2023
CVE-2023-4170
19Monitor
DedeBIZ Article cross site scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
dedebiz · dedebizAug 5, 2023