Threat database

CVE-2026-116063 is a code injection vulnerability in DedeCMS version 5.7.118. The flaw exists in the require_once function within the dede/update_guide.php file, where manipulation of the 'vtime' argument allows injection of arbitrary code. This vulnerability can be exploited remotely without user interaction but requires high privileges. The CVSS 4.0 score rates it as medium severity. Public exploit code is available, but no known active exploitation has been reported. No patch or remediation details are provided in the source data.

A security flaw has been discovered in DedeCMS 5.7.118. Affected by this vulnerability is the function ExtractFile of the file include/zip.class.php of the component Album Publishing Feature. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

DedeCMS version 5.7.118 contains a code injection vulnerability in the /plus/search.php file within the Column Management component. The vulnerability arises from improper handling of the 'Column Name' argument, allowing remote attackers to inject code. This issue has a medium severity rating with a CVSS score of 5.1. No official patch or remediation guidance is currently available, and public exploit code has been released.

DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.

A vulnerability was found in DedeCMS up to 5.7.2 and classified as critical. This issue affects some unknown processing of the file /include/dedetag.class.php of the component Template Handler. The manipulation of the argument notes leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.

Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php component.

A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_main.php.