A security vulnerability has been detected in DeDeCMS 53_1_UTF8. (CVE-2026-76783)

The vulnerability in DeDeCMS 53_1_UTF8 involves improper sanitization of the 'sql' parameter in the /plus/advancedsearch.php file, which leads to SQL injection (CWE-74). This flaw allows a remote attacker to inject arbitrary SQL commands, potentially impacting confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable without authentication and has a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Public exploit details have been disclosed, but no active exploitation has been confirmed.

Successful exploitation can lead to unauthorized disclosure of information, modification of data, and disruption of service due to SQL injection. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. Since the attack can be launched remotely without privileges or user interaction, it poses a moderate risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable /plus/advancedsearch.php functionality or apply web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'sql' parameter.