Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
186 results · page 3 of 4
Nov 13, 2023DedeCMS v6.2 was discovered to contain a Cross-site Scripting (XSS) vulnerability via spec_add.php.CVE-2023-48068 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS v6.2 was discovered to contain a Cross-site Scripting (XSS) vulnerability via spec_add.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2023A vulnerability classified as critical was found in DedeCMS 5.7.111.CVE-2023-5301 · Other software · Dedecms · reported by VulDBMedium 4.7
A vulnerability classified as critical was found in DedeCMS 5.7.111. This vulnerability affects the function AddMyAddon of the file album_add.php. The manipulation of the argument albumUploadFiles leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240940.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2023An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PCVE-2023-43226 · Other software · Dedecms · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical.CVE-2023-5022 · Other software · Dedecms · reported by VulDBMedium 5.5
A vulnerability has been found in DedeCMS up to 5.7.100 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_templets_post.php. The manipulation of the argument activepath leads to absolute path traversal. The associated identifier of this vulnerability is VDB-239863.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2023DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.CVE-2023-40784 · Other software · dedecms · reported by MITRECritical 9.8
DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023A vulnerability classified as critical was found in DedeCMS 5.7.110.CVE-2023-4747 · Other software · Dedecms · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in DedeCMS 5.7.110. This vulnerability affects unknown code of the file /uploads/tags.php. The manipulation of the argument tag_alias leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238636.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_edit.php via the title parameter.CVE-2023-40877 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_edit.php via the title parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_add.php via the title parameter.CVE-2023-40876 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_add.php via the title parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_edit.php via the votename and voCVE-2023-40875 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_edit.php via the votename and votenote parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_add.php via the votename and votCVE-2023-40874 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_add.php via the votename and voteitem1 parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).CVE-2023-36298 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php.CVE-2023-34842 · Other software · Dedecms · reported by MITRECritical 9.8
Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddedecms.comdedecms.com
Jul 13, 2023An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via uploading a crafted PCVE-2023-37839 · Other software · Dedecms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2023A vulnerability classified as critical was found in DedeCMS 5.7.109.CVE-2023-3578 · Other software · Dedecms · reported by VulDBMedium 5.5
A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233371.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023A vulnerability was found in DedeCMS up to 5.7.106.CVE-2023-2928 · Other software · Dedecms · reported by VulDBMedium 6.3
A vulnerability was found in DedeCMS up to 5.7.106. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file uploads/dede/article_allowurl_edit.php. The manipulation of the argument allurls leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230083.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023DedeCMS up to v5.7.108 is vulnerable to XSS in sys_info.php via parameters 'edit___cfg_powerby' and 'edit___cfg_beian'CVE-2023-31757 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS up to v5.7.108 is vulnerable to XSS in sys_info.php via parameters 'edit___cfg_powerby' and 'edit___cfg_beian'
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2023A vulnerability was found in DedeCMS 5.7.106 and classified as critical.CVE-2023-2424 · Other software · Dedecms · reported by VulDBMedium 6.3
A vulnerability was found in DedeCMS 5.7.106 and classified as critical. Affected by this issue is the function UpDateMemberModCache of the file uploads/dede/config.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-227750 is the identifier assigned to this vulnerability.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2023An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal.CVE-2023-30380 · Other software · Dedecms · reported by MITREHigh 7.5
An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.CVE-2023-27733 · Other software · Dedecms · reported by MITREHigh 7.2
DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsha999-crypto.github.io
Apr 14, 2023A vulnerability was found in DedeCMS 5.7.87.CVE-2023-2059 · Other software · Dedecms · reported by VulDBMedium 4.3
A vulnerability was found in DedeCMS 5.7.87. It has been rated as problematic. Affected by this issue is some unknown functionality of the file uploads/include/dialog/select_templets.php. The manipulation leads to path traversal: '..\filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225944.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical.CVE-2023-2056 · Other software · Dedecms · reported by VulDBMedium 6.3
A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical. This issue affects the function GetSystemFile of the file module_main.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225941 was assigned to this vulnerability.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dedestory_catalog.phpCVE-2023-27709 · Other software · Dedecms · reported by MITREHigh 7.2
SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dedestory_catalog.php endpoint.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsrpopty.github.iosrpopty.github.io
Mar 16, 2023SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php CVE-2023-27707 · Other software · Dedecms · reported by MITREHigh 7.2
SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php endpoint.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsrpopty.github.iosrpopty.github.io
Feb 2, 2023DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename.CVE-2022-48140 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022dedecms <=V5.7.102 is vulnerable to SQL Injection.CVE-2022-46442 · Other software · Dedecms · reported by MITRECritical 9.8
dedecms <=V5.7.102 is vulnerable to SQL Injection. In sys_ sql_ n query.php there are no restrictions on the sql query.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 23, 2022dedecmdv6 6.1.9 is vulnerable to SQL Injection.CVE-2022-44120 · Other software · Dedebiz · reported by MITRECritical 9.8
dedecmdv6 6.1.9 is vulnerable to SQL Injection. via sys_sql_query.php.
- Product
- Dedecmsv6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 23, 2022dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.CVE-2022-44118 · Other software · Dedebiz · reported by MITRECritical 9.8
dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
- Product
- Dedecmsv6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 23, 2022dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.CVE-2022-43196 · Other software · Dedebiz · reported by MITRECritical 9.1
dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.
- Product
- Dedecmsv6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 17, 2022An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a craftCVE-2022-43192 · Other software · Dedecms · reported by MITREMedium 6.7
An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is related to an incomplete fix for CVE-2022-40886.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin pCVE-2022-43031 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 11, 2022DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php.CVE-2022-40921 · Other software · Dedecms · reported by MITREHigh 7.2
DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2022DedeCMS 5.7.98 has a file upload vulnerability in the background.CVE-2022-40886 · Other software · Dedecms · reported by MITREHigh 7.2
DedeCMS 5.7.98 has a file upload vulnerability in the background.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/co_do.php via the dopost, rpok, and aid parameters.CVE-2022-36583 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/co_do.php via the dopost, rpok, and aid parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Aug 17, 2022DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php.CVE-2022-36216 · Other software · Dedecms · reported by MITREHigh 7.2
DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.CVE-2022-36215 · Other software · Dedebiz · reported by MITREHigh 7.2
DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.
- Product
- Dedecmsv6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.CVE-2022-35516 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2022DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.CVE-2022-34531 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter.CVE-2022-30508 · Other software · Dedecms · reported by MITREMedium 6.5
DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter.CVE-2022-23337 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote.youdao.comnote.youdao.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`,CVE-2020-36497 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`, `userid`, and `templet' parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component sys_admin_user_edit.php via the `filename`, `midCVE-2020-36496 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component sys_admin_user_edit.php via the `filename`, `mid`, `userid`, and `templet' parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `filename`, `mid`, CVE-2020-36495 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `filename`, `mid`, `userid`, and `templet' parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component mychannel_edit.php via the `filename`, `mid`, `uCVE-2020-36494 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component mychannel_edit.php via the `filename`, `mid`, `userid`, and `templet' parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component media_main.php via the `activepath`, `keyword`, CVE-2020-36493 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component media_main.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component select_media.php via the `activepath`, `keyword`CVE-2020-36492 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component select_media.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tags_main.php via the `activepath`, `keyword`, `CVE-2020-36491 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tags_main.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `activepath`, `keywCVE-2020-36490 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`, `mid`, `userid`, andCVE-2020-23046 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`, `mid`, `userid`, and `templet' parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic_view.php via the `activepath`, `keywordCVE-2020-23044 · Other software · Dedecms · reported by MITREMedium 5.4
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic_view.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Aug 27, 2021An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format.CVE-2020-18114 · Other software · Dedecms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.