CVE-2026-15533 is a code injection vulnerability affecting DedeCMS 5.7.118. The flaw exists in an unspecified function in /plus/search.php related to Column Management. By manipulating the 'Column Name' argument, an attacker can inject code remotely. The vulnerability has been publicly disclosed with exploit code available. There is no vendor advisory or official fix information provided at this time.

Successful exploitation allows remote code injection via the 'Column Name' parameter, potentially enabling attackers to execute arbitrary code on the affected system. This could lead to unauthorized control or compromise of the DedeCMS installation. The CVSS score of 5.1 indicates a medium impact with network attack vector and low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the vulnerable endpoint and validating or sanitizing input parameters at the application or web server level to mitigate exploitation risk.