DE
Product
DedeCMS
179
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 30High 57Medium 88Low 0
Watch
Add DedeCMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-43192 | 6.7 | Nov 17 | An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a crafted PHP file Affected: 5.7.101 |
| CVE-2024-57241 | 6.5 | Feb 11 | Dedecms 5.71sp1 and earlier is vulnerable to URL redirect Affected: All versions, or not specified |
| CVE-2024-34245 | 6.5 | May 14 | An arbitrary file read vulnerability in DedeCMS v5.7.114 allows authenticated attackers to read arbitrary files by specifying any path in makehtml_js_action.php Affected: 5.7.114 |
| CVE-2022-30508 | 6.5 | May 26 | DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter Affected: 5.7.93 |
| CVE-2019-10014 | 6.5 | Mar 24 | In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is… Affected: 5.7 |
| CVE-2026-76800 | 6.3 | Aug 20 | DeDeCMS select_media_post.php unrestricted upload Affected: 3 |
| CVE-2026-10581 | 6.3 | Jun 2 | DedeCMS download.php base64_decode server-side request forgery Affected: 5.7.88 |
| CVE-2024-28682 | 6.3 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php Affected: 5.7 |
| CVE-2024-28678 | 6.3 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_description_main.php Affected: 5.7 |
| CVE-2014-125131 | 6.1 | Oct 20 | DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php Affected: 5.6; 5.7 |
| CVE-2024-46372 | 6.1 | Sep 18 | DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module Affected: 5.7.115 |
| CVE-2024-33371 | 6.1 | Apr 30 | Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the makehtml_list_action.php component Affected: 5.7.113 |
| CVE-2024-28683 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via create file Affected: 5.7 |
| CVE-2024-28681 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php Affected: 5.7 |
| CVE-2024-28680 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_add.php Affected: 5.7 |
| CVE-2024-28679 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via Photo Collection Affected: 5.7 |
| CVE-2024-28677 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_main.php Affected: 5.7 |
| CVE-2024-28676 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via /dede/article_edit.php Affected: 5.7 |
| CVE-2024-28670 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_main.php Affected: 5.7 |
| CVE-2024-28668 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychannel_add.php Affected: 5.7 |
| CVE-2024-28667 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/templets_one_edit.php Affected: 5.7 |
| CVE-2024-28430 | 6.1 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_edit.php Affected: 5.7 |
| CVE-2023-49494 | 6.1 | Dec 11 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php Affected: 5.7.111 |
| CVE-2023-49493 | 6.1 | Dec 7 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php Affected: 5.7.111 |
| CVE-2023-49492 | 6.1 | Dec 7 | DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php Affected: 5.7.111 |
| CVE-2022-36583 | 6.1 | Sep 1 | DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/co_do.php via the dopost, rpok, and aid parameters Affected: 5.7.97 |
| CVE-2020-36497 | 6.1 | Oct 22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`, `userid`, and… Affected: 7.5 |
| CVE-2020-36496 | 6.1 | Oct 22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component sys_admin_user_edit.php via the `filename`, `mid`, `userid`, and… Affected: 7.5 |
| CVE-2020-36495 | 6.1 | Oct 22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `filename`, `mid`, `userid`, and… Affected: 7.5 |
| CVE-2020-36494 | 6.1 | Oct 22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component mychannel_edit.php via the `filename`, `mid`, `userid`, and… Affected: 7.5 |
| CVE-2020-23046 | 6.1 | Oct 22 | DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`, `mid`, `userid`, and `templet'… Affected: 7.5 |
| CVE-2018-18782 | 6.1 | Oct 29 | Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter Affected: 5.7 |
| CVE-2018-18781 | 6.1 | Oct 29 | DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter Affected: 5.7 |
| CVE-2018-18608 | 6.1 | Oct 23 | DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some… Affected: 5.7 |
| CVE-2018-18579 | 6.1 | Oct 22 | Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter Affected: 5.7 |
| CVE-2018-18578 | 6.1 | Oct 22 | DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter Affected: 5.7 |
| CVE-2018-16786 | 6.1 | Sep 21 | DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php Affected: 5.7 |
| CVE-2024-34959 | 5.5 | May 17 | DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys_data_replace.php Affected: 5.7.113 |
| CVE-2024-30946 | 5.5 | Apr 2 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/co_do.php Affected: 5.7 |
| CVE-2024-28666 | 5.5 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/media_add.php Affected: 5.7 |
| CVE-2024-28429 | 5.5 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php Affected: 5.7 |
| CVE-2024-12183 | 5.4 | Dec 4 | DedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scripting Affected: before 5.7.116 |
| CVE-2024-12182 | 5.4 | Dec 4 | DedeCMS soft_add.php cross site scripting Affected: before 5.7.116 |
| CVE-2024-12181 | 5.4 | Dec 4 | DedeCMS SWF File uploads_add.php cross site scripting Affected: before 5.7.116 |
| CVE-2024-12180 | 5.4 | Dec 4 | DedeCMS article_add.php cross site scripting Affected: before 5.7.116 |
| CVE-2024-28672 | 5.4 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php Affected: 5.7 |
| CVE-2024-28669 | 5.4 | Mar 13 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php Affected: 5.7 |
| CVE-2023-48068 | 5.4 | Nov 13 | DedeCMS v6.2 was discovered to contain a Cross-site Scripting (XSS) vulnerability via spec_add.php Affected: 6.2 |
| CVE-2023-40877 | 5.4 | Aug 24 | DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_edit.php via the title parameter Affected: through 5.7.110 |
| CVE-2023-40876 | 5.4 | Aug 24 | DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_add.php via the title parameter Affected: through 5.7.110 |