CVSS: 5.3EPSS: 6%CPEs: 1EXPL: 1CVE-2023-2059 – DedeCMS select_templets.php path traversal
https://notcve.org/view.php?id=CVE-2023-2059
14 Apr 2023 — A vulnerability was found in DedeCMS 5.7.87. It has been rated as problematic. Affected by this issue is some unknown functionality of the file uploads/include/dialog/select_templets.php. The manipulation leads to path traversal: '..\filedir'. • https://github.com/ATZXC-RedTeam/cve/blob/main/dedecms.md • CWE-28: Path Traversal: '..\filedir' •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2056 – DedeCMS module_main.php GetSystemFile code injection
https://notcve.org/view.php?id=CVE-2023-2056
14 Apr 2023 — A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical. This issue affects the function GetSystemFile of the file module_main.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://gitee.com/ashe-king/cve/blob/master/dedecms%20rce2.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27709
https://notcve.org/view.php?id=CVE-2023-27709
16 Mar 2023 — SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dedestory_catalog.php endpoint. • https://srpopty.github.io/2023/02/27/DedeCMS-V5.7.160-Backend-SQLi-story • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27707
https://notcve.org/view.php?id=CVE-2023-27707
16 Mar 2023 — SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php endpoint. • https://srpopty.github.io/2023/02/27/DedeCMS-V5.7.160-Backend-SQLi-group • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46442
https://notcve.org/view.php?id=CVE-2022-46442
27 Dec 2022 — dedecms <=V5.7.102 is vulnerable to SQL Injection. In sys_ sql_ n query.php there are no restrictions on the sql query. dedecms <=V5.7.102 es vulnerable a la inyección SQL. En sys_ sql_ n query.php no hay restricciones en la consulta SQL. • https://gist.github.com/yinfei6/f2b311374de4b4cec1dc22433d38c92a • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23337
https://notcve.org/view.php?id=CVE-2022-23337
14 Feb 2022 — DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter. Se ha detectado que DedeCMS versión v5.7.87, contiene una vulnerabilidad de inyección SQL en el archivo article_coonepage_rule.php por medio del parámetro ids • http://note.youdao.com/noteshare?id=608f19009c8bd1ace5f1a59c1ddd657b • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18114
https://notcve.org/view.php?id=CVE-2020-18114
27 Aug 2021 — An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format. Una vulnerabilidad de carga de archivos arbitrarios en el componente /uploads/dede de DedeCMS versión V5.7SP2, permite a atacantes carfar un webshell en manerato HTM. • https://blog.csdn.net/qq_36093477/article/details/86681178 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18917
https://notcve.org/view.php?id=CVE-2020-18917
24 Aug 2021 — The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control. El componente plus/search.php de DedeCMS versión 5.7 SP2, permite a atacantes remotos ejecutar código PHP arbitrario por medio del parámetro typename porque el contenido del archivo typename.inc está bajo el control de un atacante. • http://tusk1.cn/2019/05/12/DeDecms-v5-7-sp2-CRSF-%E6%96%87%E4%BB%B6%E6%93%8D%E4%BD%9C-%E5%89%8D%E5%8F%B0getshell • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2020-22198
https://notcve.org/view.php?id=CVE-2020-22198
16 Jun 2021 — SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php. Una vulnerabilidad de inyección SQL en DedeCMS versión 5.7 por medio de un parámetro mdescription en el archivo member/ajax_membergroup.php • http://www.hackdig.com/?02/hack-8391.htm • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-16632
https://notcve.org/view.php?id=CVE-2020-16632
14 May 2021 — A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter. Una vulnerabilidad de tipo XSS en el archivo /uploads/dede/action_search.php en DedeCMS versión V5.7 SP2, permite a un usuario autenticado ejecutar código arbitrario remoto por medio del parámetro keyword • https://github.com/ky-j/dedecms/issues/12 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •