# DedeCMS. Every CVE that names DedeCMS among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php](https://agentprime.io/advisories/CVE-2010-20125.md) `CVE-2010-20125` · CVE record: DedeCMS DedeCMS · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: File inclusion - [DedeCMS Advertisement Rendering ad_js.php \_RunMagicQuotes code injection](https://agentprime.io/advisories/CVE-2026-116253.md) `CVE-2026-116253` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Code injection - [DedeCMS update_guide.php require_once code injection](https://agentprime.io/advisories/CVE-2026-116063.md) `CVE-2026-116063` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Other injection, Code injection - [DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php](https://agentprime.io/advisories/CVE-2021-48016.md) `CVE-2021-48016` · CVE record: DedeCMS DedeCMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Code injection - [DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php](https://agentprime.io/advisories/CVE-2014-125131.md) `CVE-2014-125131` · CVE record: DedeCMS DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site scripting (XSS) - [DedeCMS mytag_js.php code injection](https://agentprime.io/advisories/CVE-2026-94004.md) `CVE-2026-94004` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: Other injection, Code injection - [DeDeCMS select_media_post.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-76800.md) `CVE-2026-76800` · CVE record: DeDeCMS · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Broken access control, Unrestricted file upload - [DeDeCMS advancedsearch.php sql injection](https://agentprime.io/advisories/CVE-2026-76783.md) `CVE-2026-76783` · CVE record: DeDeCMS · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Other injection, SQL injection - [DedeCMS Installation Wizard index.php \_4_Setup file inclusion](https://agentprime.io/advisories/CVE-2026-19353.md) `CVE-2026-19353` · CVE record: DedeCMS · CVSS 2.3 Low · Not analysed yet · Published 9 Aug 2026 · Tags: Path traversal - [DedeCMS Album Publishing Feature zip.class.php ExtractFile path traversal](https://agentprime.io/advisories/CVE-2026-15700.md) `CVE-2026-15700` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Path traversal - [DedeCMS Column Management search.php code injection](https://agentprime.io/advisories/CVE-2026-15533.md) `CVE-2026-15533` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, Code injection - [DedeCMS carbuyaction.php RemoveXSS sql injection](https://agentprime.io/advisories/CVE-2026-10608.md) `CVE-2026-10608` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, SQL injection - [DedeCMS flink.php dede_htmlspecialchars sql injection](https://agentprime.io/advisories/CVE-2026-10607.md) `CVE-2026-10607` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, SQL injection - [DedeCMS Feedback feedback.php TrimMsg sql injection](https://agentprime.io/advisories/CVE-2026-10606.md) `CVE-2026-10606` · CVE record: DedeCMS · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, SQL injection - [DedeCMS download.php base64_decode server-side request forgery](https://agentprime.io/advisories/CVE-2026-10581.md) `CVE-2026-10581` · CVE record: DedeCMS · CVSS 5.3 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Server-side request forgery (SSRF) - [DedeCMS freelist_main.php sql injection](https://agentprime.io/advisories/CVE-2025-15004.md) `CVE-2025-15004` · CVE record: DedeCMS · CVSS 5.3 Medium · Not analysed yet · Published 22 Dec 2025 · Tags: Other injection, SQL injection - [DedeCMS Template dedetag.class.php command injection](https://agentprime.io/advisories/CVE-2025-6335.md) `CVE-2025-6335` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 20 Jun 2025 · Tags: Other injection, Command injection - [DedeCMS Incomplete Fix CVE-2018-9175 sys_verifies.php code injection](https://agentprime.io/advisories/CVE-2025-5137.md) `CVE-2025-5137` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 25 May 2025 · Tags: Other injection, Code injection - [DedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scripting](https://agentprime.io/advisories/CVE-2024-12183.md) `CVE-2024-12183` · CVE record: DedeCMS · CVSS 5.3 Medium · Not analysed yet · Published 4 Dec 2024 · Tags: Cross-site scripting (XSS), Code injection - [DedeCMS soft_add.php cross site scripting](https://agentprime.io/advisories/CVE-2024-12182.md) `CVE-2024-12182` · CVE record: DedeCMS · CVSS 5.3 Medium · Not analysed yet · Published 4 Dec 2024 · Tags: Cross-site scripting (XSS), Code injection - [DedeCMS SWF File uploads_add.php cross site scripting](https://agentprime.io/advisories/CVE-2024-12181.md) `CVE-2024-12181` · CVE record: DedeCMS · CVSS 5.3 Medium · Not analysed yet · Published 4 Dec 2024 · Tags: Cross-site scripting (XSS), Code injection - [DedeCMS article_add.php cross site scripting](https://agentprime.io/advisories/CVE-2024-12180.md) `CVE-2024-12180` · CVE record: DedeCMS · CVSS 5.3 Medium · Not analysed yet · Published 4 Dec 2024 · Tags: Cross-site scripting (XSS), Code injection - [DedeCMS friendlink_add.php unrestricted upload](https://agentprime.io/advisories/CVE-2024-11138.md) `CVE-2024-11138` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: Broken access control, Unrestricted file upload - [DedeCMS article_string_mix.php os command injection](https://agentprime.io/advisories/CVE-2024-9076.md) `CVE-2024-9076` · CVE record: DedeCMS · CVSS 5.1 Medium · EPSS 0.21 · Not analysed yet · Published 22 Sept 2024 · Tags: Command injection - [DedeCMS article_template_rand.php code injection](https://agentprime.io/advisories/CVE-2024-6940.md) `CVE-2024-6940` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 21 Jul 2024 · Tags: Code injection - [DedeCMS path traversal](https://agentprime.io/advisories/CVE-2024-4790.md) `CVE-2024-4790` · CVE record: DedeCMS · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2024 · Tags: Path traversal - [DedeCMS sys_safe.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4594.md) `CVE-2024-4594` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS sys_multiserv.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4593.md) `CVE-2024-4593` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS sys_group_edit.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4592.md) `CVE-2024-4592` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS sys_group_add.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4591.md) `CVE-2024-4591` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS sys_info.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4590.md) `CVE-2024-4590` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS mytag_edit.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4589.md) `CVE-2024-4589` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS mytag_add.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4588.md) `CVE-2024-4588` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS tpl.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4587.md) `CVE-2024-4587` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS shops_delivery.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4586.md) `CVE-2024-4586` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS member_type.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-4585.md) `CVE-2024-4585` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 7 May 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS update_guide.php path traversal](https://agentprime.io/advisories/CVE-2024-3686.md) `CVE-2024-3686` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 12 Apr 2024 · Tags: Path traversal - [DedeCMS stepselect_main.php sql injection](https://agentprime.io/advisories/CVE-2024-3685.md) `CVE-2024-3685` · CVE record: DedeCMS · CVSS 6.3 Medium · Not analysed yet · Published 12 Apr 2024 · Tags: SQL injection - [DedeCMS makehtml_archives_action.php sql injection](https://agentprime.io/advisories/CVE-2024-3148.md) `CVE-2024-3148` · CVE record: DedeCMS · CVSS 6.3 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: SQL injection - [DedeCMS makehtml_map.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-3147.md) `CVE-2024-3147` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS makehtml_rss_action.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-3146.md) `CVE-2024-3146` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS makehtml_js_action.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-3145.md) `CVE-2024-3145` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS makehtml_spec.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-3144.md) `CVE-2024-3144` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS member_rank.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-3143.md) `CVE-2024-3143` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS mda_main.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-2823.md) `CVE-2024-2823` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 22 Mar 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS vote_edit.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-2822.md) `CVE-2024-2822` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 22 Mar 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS friendlink_edit.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-2821.md) `CVE-2024-2821` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 22 Mar 2024 · Tags: Cross-site request forgery (CSRF) - [DedeCMS baidunews.php cross-site request forgery](https://agentprime.io/advisories/CVE-2024-2820.md) `CVE-2024-2820` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 22 Mar 2024 · Tags: Cross-site request forgery (CSRF) - [DeDeCMS Backend file_class.php unrestricted upload](https://agentprime.io/advisories/CVE-2023-7212.md) `CVE-2023-7212` · CVE record: DeDeCMS · CVSS 4.7 Medium · Not analysed yet · Published 7 Jan 2024 · Tags: Unrestricted file upload - [DedeCMS album_add.php AddMyAddon os command injection](https://agentprime.io/advisories/CVE-2023-5301.md) `CVE-2023-5301` · CVE record: DedeCMS · CVSS 4.7 Medium · Not analysed yet · Published 30 Sept 2023 · Tags: Command injection - [DedeCMS select_templets_post.php absolute path traversal](https://agentprime.io/advisories/CVE-2023-5022.md) `CVE-2023-5022` · CVE record: DedeCMS · CVSS 5.5 Medium · Not analysed yet · Published 17 Sept 2023 · Tags: Path traversal - [DedeCMS tags.php sql injection](https://agentprime.io/advisories/CVE-2023-4747.md) `CVE-2023-4747` · CVE record: DedeCMS · CVSS 6.3 Medium · Not analysed yet · Published 4 Sept 2023 · Tags: SQL injection - [DedeCMS co_do.php server-side request forgery](https://agentprime.io/advisories/CVE-2023-3578.md) `CVE-2023-3578` · CVE record: DedeCMS · CVSS 5.5 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: Server-side request forgery (SSRF) - [DedeCMS article_allowurl_edit.php code injection](https://agentprime.io/advisories/CVE-2023-2928.md) `CVE-2023-2928` · CVE record: DedeCMS · CVSS 6.3 Medium · EPSS 0.51 · Not analysed yet · Published 27 May 2023 · Tags: Code injection - [DedeCMS config.php UpDateMemberModCache unrestricted upload](https://agentprime.io/advisories/CVE-2023-2424.md) `CVE-2023-2424` · CVE record: DedeCMS · CVSS 6.3 Medium · Not analysed yet · Published 29 Apr 2023 · Tags: Unrestricted file upload - [DedeCMS select_templets.php path traversal](https://agentprime.io/advisories/CVE-2023-2059.md) `CVE-2023-2059` · CVE record: DedeCMS · CVSS 4.3 Medium · Not analysed yet · Published 14 Apr 2023 · Tags: CWE-28 - [DedeCMS module_main.php GetSystemFile code injection](https://agentprime.io/advisories/CVE-2023-2056.md) `CVE-2023-2056` · CVE record: DedeCMS · CVSS 6.3 Medium · Not analysed yet · Published 14 Apr 2023 · Tags: Code injection ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .