CVE-2026-10606 is a SQL injection vulnerability affecting DedeCMS 5.7.88. The issue resides in the TrimMsg function of the /plus/feedback.php file, part of the Feedback Handler component. By manipulating the 'msg' parameter, an attacker can inject SQL commands remotely without authentication or user interaction. The vulnerability has been publicly disclosed, and the CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, low complexity, and no privileges required. No official patch or remediation level has been documented in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, no confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying workarounds such as input validation or disabling the vulnerable feedback functionality if feasible. Monitor vendor channels for updates and patches addressing this vulnerability.