CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-7212 – DeDeCMS Backend file_class.php unrestricted upload
https://notcve.org/view.php?id=CVE-2023-7212
A vulnerability classified as critical has been found in DeDeCMS up to 5.7.112. Affected is an unknown function of the file file_class.php of the component Backend. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://hmxwjm7x03.feishu.cn/docx/FPjhdYcQvocR4gxy34Rc0pmon5e?from=from_copylink https://vuldb.com/?ctiid.249768 https://vuldb.com/?id.249768 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-49494
https://notcve.org/view.php?id=CVE-2023-49494
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php. Se descubrió que DedeCMS v5.7.111 contiene una vulnerabilidad de cross-site scripting (XSS) reflectantes a través del componente select_media_post_wangEditor.php. • http://dedecms.com https://github.com/Hebing123/cve/issues/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-49492
https://notcve.org/view.php?id=CVE-2023-49492
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages.php. Se descubrió que DedeCMS v5.7.111 contiene una vulnerabilidad Cross-Site Scripting (XSS) Reflectante a través del parámetro imgstick en selectimages.php. • https://github.com/Hebing123/cve/issues/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-49493
https://notcve.org/view.php?id=CVE-2023-49493
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php. Se descubrió que DedeCMS v5.7.111 contiene una vulnerabilidad de Cross-Site Scripting (XSS) Reflectante a través del parámetro v en selectimages.php. • https://github.com/Hebing123/cve/issues/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-43275
https://notcve.org/view.php?id=CVE-2023-43275
Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers to create crafted web pages due to a lack of verification of the token value of the submitted form. Vulnerabilidad deCross-Site Request Forgery (CSRF) en DedeCMS v5.7 en la interfaz de administración de backend 110 a través de /catalog_add.php, permite a los atacantes crear páginas web manipuladas debido a la falta de verificación del valor del token del formulario enviado. • https://github.com/thedarknessdied/dedecms/blob/main/v5.7_110-CSRF.md • CWE-352: Cross-Site Request Forgery (CSRF) •