CVE-2026-15533 is a code injection vulnerability affecting DedeCMS 5.7.118. The issue exists in an unspecified function of the /plus/search.php file related to Column Management. By manipulating the 'Column Name' parameter, an attacker can inject arbitrary code remotely. The vulnerability is rated medium severity with a CVSS 4.0 base score of 5.1. No official fix or patch has been documented as of the publication date. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this vulnerability allows remote attackers to inject and execute arbitrary code on the affected system. This can lead to unauthorized control or compromise of the web application and potentially the underlying server. The medium severity score reflects the potential impact balanced against the required privileges and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the vulnerable endpoint, applying web application firewall rules to detect and block malicious input targeting the 'Column Name' parameter, and monitoring for exploitation attempts.