Skip to content
Noroxi

dedecms records

166 published records for vendor dedecms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
22
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

166 records
  • CVE-2018-7700
    57Plan

    DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify

    HighCVSS 8.8Proof of conceptEPSS 74%

    dedecms · dedecmsMar 27, 2018

  • CVE-2015-4553
    52Plan

    A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.

    HighCVSS 8.8Proof of conceptEPSS 57%

    dedecms · dedecmsJan 6, 2020

  • CVE-2023-2928
    50Plan

    DedeCMS article_allowurl_edit.php code injection

    HighCVSS 8.8Proof of conceptEPSS 51%

    dedecms · dedecmsMay 27, 2023

  • CVE-2022-34531
    46Plan

    DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.

    CriticalCVSS 9.8No exploitEPSS 25%

    dedecms · dedecmsJul 29, 2022

  • CVE-2017-17731
    43Plan

    DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    dedecms · dedecmsDec 18, 2017

  • CVE-2023-3578
    40Plan

    DedeCMS co_do.php server-side request forgery

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    dedecms · dedecmsJul 10, 2023

  • CVE-2022-35516
    40Plan

    DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.

    CriticalCVSS 9.8No exploitEPSS 3%

    dedecms · dedecmsAug 17, 2022

  • CVE-2022-23337
    40Plan

    DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter.

    CriticalCVSS 9.8No exploitEPSS 2%

    dedecms · dedecmsFeb 14, 2022

  • CVE-2018-9175
    40Plan

    DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code

    CriticalCVSS 9.8No exploitEPSS 2%

    dedecms · dedecmsApr 1, 2018

  • CVE-2020-18114
    40Plan

    An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format

    CriticalCVSS 9.8No exploitEPSS 2%

    dedecms · dedecmsAug 27, 2021

  • CVE-2018-19061
    40Plan

    DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter.

    CriticalCVSS 9.8No exploitEPSS 2%

    dedecms · dedecmsNov 7, 2018

  • CVE-2020-22198
    40Plan

    SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php.

    CriticalCVSS 9.8No exploitEPSS 2%

    dedecms · dedecmsJun 16, 2021

  • CVE-2018-9174
    39Monitor

    sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsApr 1, 2018

  • CVE-2018-12045
    39Monitor

    DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request wit

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsJun 7, 2018

  • CVE-2018-10375
    39Monitor

    A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to uploa

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsApr 25, 2018

  • CVE-2023-37839
    39Monitor

    An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via u

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsJul 13, 2023

  • CVE-2023-34842
    39Monitor

    Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /de

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsJul 31, 2023

  • CVE-2017-17730
    39Monitor

    DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsDec 18, 2017

  • CVE-2026-30694
    39Monitor

    An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsMar 19, 2026

  • CVE-2023-2056
    39Monitor

    DedeCMS module_main.php GetSystemFile code injection

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsApr 14, 2023

  • CVE-2026-30643
    39Monitor

    An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsApr 1, 2026

  • CVE-2024-35510
    39Monitor

    An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via u

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsMay 28, 2024

  • CVE-2023-40784
    39Monitor

    DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsSep 12, 2023

  • CVE-2023-4747
    39Monitor

    DedeCMS tags.php sql injection

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsSep 3, 2023

  • CVE-2024-29661
    39Monitor

    A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.

    CriticalCVSS 9.8No exploitEPSS 1%

    dedecms · dedecmsApr 22, 2024