Dedecms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-48016 DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and inclCritical 9.3 · Oct 22, 2026
• CVE-2026-30643 An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.Critical 9.8 · Apr 1, 2026
• CVE-2026-29839 DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.High 8.8 · Mar 24, 2026
• CVE-2026-30694 An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter componentCritical 9.8 · Mar 19, 2026
• CVE-2024-30855 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.High 8.8 · Dec 29, 2025
• CVE-2024-46373 Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.High 8.8 · Sep 18, 2024
• CVE-2024-42636 DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.High 7.2 · Aug 23, 2024
• CVE-2024-35510 An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via uploading a crafted fCritical 9.8 · May 28, 2024
• CVE-2024-35375 There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMSCritical 9.8 · May 23, 2024
• CVE-2024-33749 DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php.Critical 9.1 · May 6, 2024
• CVE-2024-29661 A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.Critical 9.8 · Apr 22, 2024
• CVE-2024-30965 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/member_scores.php.High 8.8 · Apr 2, 2024
• CVE-2024-29684 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execuCritical 9.8 · Mar 26, 2024
• CVE-2024-28673 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/mychannel_edit.php.High 8.8 · Mar 13, 2024
• CVE-2024-28671 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/stepselect_main.php.High 8.8 · Mar 13, 2024
• CVE-2024-28684 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/module_main.phpHigh 8.8 · Mar 13, 2024
• CVE-2024-28675 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.phpHigh 8.8 · Mar 13, 2024
• CVE-2024-28665 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_add.phpHigh 8.8 · Mar 13, 2024
• CVE-2024-28432 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/article_edit.php.High 8.8 · Mar 13, 2024
• CVE-2024-28431 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_del.php.High 8.8 · Mar 13, 2024
• CVE-2023-52047 Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager.High 8.8 · Feb 28, 2024
• CVE-2024-22895 DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.High 8.8 · Jan 22, 2024
• CVE-2023-43275 Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted webHigh 8.8 · Nov 16, 2023
• CVE-2023-43226 An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PHigh 8.8 · Sep 28, 2023
• CVE-2023-40784 DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.Critical 9.8 · Sep 12, 2023