CVE-2026-10608 is a SQL injection vulnerability affecting DedeCMS 5.7.88. The flaw exists in the RemoveXSS function of the /plus/carbuyaction.php file, where manipulation of the postname/des parameter can lead to SQL injection. This vulnerability can be exploited remotely without authentication or user interaction. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. No official fix or patch is currently documented.

Successful exploitation of this vulnerability allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the affected DedeCMS installation. The medium CVSS score reflects moderate risk, with low impact on confidentiality, integrity, and availability but ease of exploitation due to no required privileges or user interaction. Publicly available exploit code increases the likelihood of attacks against unpatched systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying manual input validation or filtering on the postname/des parameter in /plus/carbuyaction.php to mitigate SQL injection risks. Monitoring for unusual database activity and restricting access to the vulnerable script may also reduce exposure.