Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
186 results · page 4 of 4
Aug 24, 2021The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typenaCVE-2020-18917 · Other software · Dedecms · reported by MITREHigh 8.8
The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2021SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php.CVE-2020-22198 · Other software · Dedecms · reported by MITRECritical 9.8
SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2021DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.CVE-2021-32073 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2021A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parametCVE-2020-16632 · Other software · Dedecms · reported by MITREMedium 5.4
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2020A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other usCVE-2020-27533 · Other software · Dedecms · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 6, 2020A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.CVE-2015-4553 · Other software · Dedecms · reported by MITREHigh 8.8
A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Mar 24, 2019In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because theCVE-2019-10014 · Other software · Dedecms · reported by MITREMedium 6.5
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Feb 18, 2019In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this filCVE-2019-8933 · Other software · Dedecms · reported by MITREHigh 8.8
In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on New Template, and modifying the filename from ../index.html to ../index.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netblog.csdn.net
Feb 16, 2019DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip=CVE-2019-8362 · Other software · Dedecms · reported by MITREHigh 7.5
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" (because input validation only checks that .jpg, .png, or .gif is present as a substring, and does not otherwise check the file name or content).
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2019uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension andCVE-2019-6289 · Other software · Dedecms · reported by MITREHigh 8.8
uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrated by the 1.pHP filename.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaolisafe.comlaolisafe.com
Dec 13, 2018An issue was discovered in DedeCMS V5.7 SP2.CVE-2018-20129 · Other software · Dedecms · reported by MITREHigh 8.8
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the filename=1.jpg.p*hp value.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Nov 7, 2018DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter.CVE-2018-19061 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commoonf1sh.github.io
Oct 29, 2018Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.CVE-2018-18782 · Other software · Dedecms · reported by MITREMedium 6.1
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.CVE-2018-18781 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2018DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at CVE-2018-18608 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2018Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter.CVE-2018-18579 · Other software · Dedecms · reported by MITREMedium 6.1
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2018DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter.CVE-2018-18578 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2018DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php.CVE-2018-16786 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2018DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.CVE-2018-16784 · Other software · Dedecms · reported by MITREHigh 7.2
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2018XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshellCVE-2018-16785 · Other software · Dedecms · reported by MITREHigh 8.8
XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2018DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with name and str parameCVE-2018-12046 · Other software · Dedecms · reported by MITREHigh 7.5
DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2018DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfile1 parametCVE-2018-12045 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2018A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrCVE-2018-10375 · Other software · Dedecms · reported by MITRECritical 9.8
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename ends in .php and contains PHP code.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2018DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database CVE-2018-9175 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the egroup parameter to uploads/dede/stepselect_main.php because code within the database is accessible to uploads/dede/sys_cache_up.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxz.aliyun.comxz.aliyun.com
Apr 1, 2018sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc areCVE-2018-9174 · Other software · Dedecms · reported by MITRECritical 9.8
sys_verifies.php in DedeCMS 5.7 allows remote attackers to execute arbitrary PHP code via the refiles array parameter, because the contents of modifytmp.inc are under an attacker's control.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxz.aliyun.comxz.aliyun.com
Mar 30, 2018file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file undeCVE-2018-9134 · Other software · Dedecms · reported by MITREHigh 8.8
file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file under the web root to achieve PHP code execution. This uses the oldfilename and newfilename parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxz.aliyun.comexchange.xforce.ibmcloud.com
Mar 27, 2018DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in cCVE-2018-7700 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaworigin.github.iolaworigin.github.io
Feb 13, 2018DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php.CVE-2018-6910 · Other software · Dedecms · reported by MITREHigh 7.5
DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkongxin.gitbook.io
Feb 11, 2018EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.CVE-2018-6881 · Other software · Dedecms · reported by MITREMedium 5.3
EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkongxin.gitbook.io
Dec 18, 2017DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.CVE-2017-17731 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2017DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.CVE-2017-17730 · Other software · Dedecms · reported by MITRECritical 9.8
DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2017DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to membCVE-2017-17727 · Other software · Dedecms · reported by MITREHigh 8.8
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2012Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) list.php, CVE-2011-5200 · Other software · Dedecms · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) list.php, (2) members.php, or (3) book.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comosvdb.org
Mar 24, 2010include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative accCVE-2010-1097 · Other software · Dedecms · reported by MITREMedium 6.8
include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to uploads/include/dialog/select_soft_post.php.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbbs.wolvez.orgosvdb.org
Oct 27, 2009SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter.CVE-2009-3806 · Other software · Dedecms · reported by MITREHigh 7.5
SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jul 1, 2009Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a file with a doCVE-2009-2270 · Other software · Dedecms · reported by MITREMedium 6.8
Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a file with a double extension in the filename, then accessing this file via unspecified vectors, as demonstrated by a .jpg.php filename.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.