Advisories · Technology

DedeCMS.

Every CVE that names DedeCMS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2010-20125 CVE record

CVSS 8.7 High

DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php
- DedeCMS
- File inclusion
Not analysed yet 30 Oct 2026
CVE-2026-116253 CVE record

CVSS 6.9 Medium

DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection
- DedeCMS
- Other injection
- Code injection
Not analysed yet 26 Oct 2026
CVE-2026-116063 CVE record

CVSS 5.1 Medium

DedeCMS update_guide.php require_once code injection
- DedeCMS
- Other injection
- Code injection
Not analysed yet 25 Oct 2026
CVE-2021-48016 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
- DedeCMS
- Code injection
Not analysed yet 22 Oct 2026
CVE-2014-125131 CVE record

CVSS 5.1 Medium

DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php
- DedeCMS
- Cross-site scripting (XSS)
Not analysed yet 20 Oct 2026
CVE-2026-94004 CVE record

CVSS 6.9 Medium

DedeCMS mytag_js.php code injection
- DedeCMS
- Other injection
- Code injection
Not analysed yet 20 Sept 2026
CVE-2026-76800 CVE record

CVSS 5.3 Medium

DeDeCMS select_media_post.php unrestricted upload
- DeDeCMS
- Broken access control
- Unrestricted file upload
Not analysed yet 20 Aug 2026
CVE-2026-76783 CVE record

CVSS 6.9 Medium

DeDeCMS advancedsearch.php sql injection
- DeDeCMS
- Other injection
- SQL injection
Not analysed yet 20 Aug 2026
CVE-2026-19353 CVE record

CVSS 2.3 Low

DedeCMS Installation Wizard index.php _4_Setup file inclusion
- DedeCMS
- Path traversal
Not analysed yet 9 Aug 2026
CVE-2026-15700 CVE record

CVSS 5.1 Medium

DedeCMS Album Publishing Feature zip.class.php ExtractFile path traversal
- DedeCMS
- Path traversal
Not analysed yet 14 Jul 2026
CVE-2026-15533 CVE record

CVSS 5.1 Medium

DedeCMS Column Management search.php code injection
- DedeCMS
- Other injection
- Code injection
Not analysed yet 13 Jul 2026
CVE-2026-10608 CVE record

CVSS 6.9 Medium

DedeCMS carbuyaction.php RemoveXSS sql injection
- DedeCMS
- Other injection
- SQL injection
Not analysed yet 2 Jun 2026
CVE-2026-10607 CVE record

CVSS 6.9 Medium

DedeCMS flink.php dede_htmlspecialchars sql injection
- DedeCMS
- Other injection
- SQL injection
Not analysed yet 2 Jun 2026
CVE-2026-10606 CVE record

CVSS 6.9 Medium

DedeCMS Feedback feedback.php TrimMsg sql injection
- DedeCMS
- Other injection
- SQL injection
Not analysed yet 2 Jun 2026
CVE-2026-10581 CVE record

CVSS 5.3 Medium

DedeCMS download.php base64_decode server-side request forgery
- DedeCMS
- Server-side request forgery (SSRF)
Not analysed yet 2 Jun 2026
CVE-2025-15004 CVE record

CVSS 5.3 Medium

DedeCMS freelist_main.php sql injection
- DedeCMS
- Other injection
- SQL injection
Not analysed yet 22 Dec 2025
CVE-2025-6335 CVE record

CVSS 5.1 Medium

DedeCMS Template dedetag.class.php command injection
- DedeCMS
- Other injection
- Command injection
Not analysed yet 20 Jun 2025
CVE-2025-5137 CVE record

CVSS 5.1 Medium

DedeCMS Incomplete Fix CVE-2018-9175 sys_verifies.php code injection
- DedeCMS
- Other injection
- Code injection
Not analysed yet 25 May 2025
CVE-2024-12183 CVE record

CVSS 5.3 Medium

DedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scripting
- DedeCMS
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 4 Dec 2024
CVE-2024-12182 CVE record

CVSS 5.3 Medium

DedeCMS soft_add.php cross site scripting
- DedeCMS
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 4 Dec 2024
CVE-2024-12181 CVE record

CVSS 5.3 Medium

DedeCMS SWF File uploads_add.php cross site scripting
- DedeCMS
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 4 Dec 2024
CVE-2024-12180 CVE record

CVSS 5.3 Medium

DedeCMS article_add.php cross site scripting
- DedeCMS
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 4 Dec 2024
CVE-2024-11138 CVE record

CVSS 5.1 Medium

DedeCMS friendlink_add.php unrestricted upload
- DedeCMS
- Broken access control
- Unrestricted file upload
Not analysed yet 12 Nov 2024
CVE-2024-9076 CVE record

CVSS 5.1 Medium

DedeCMS article_string_mix.php os command injection
- DedeCMS
- Command injection
Not analysed yet 22 Sept 2024
CVE-2024-6940 CVE record

CVSS 5.1 Medium

DedeCMS article_template_rand.php code injection
- DedeCMS
- Code injection
Not analysed yet 21 Jul 2024
CVE-2024-4790 CVE record

CVSS 5.3 Medium

DedeCMS path traversal
- DedeCMS
- Path traversal
Not analysed yet 11 May 2024
CVE-2024-4594 CVE record

CVSS 4.3 Medium

DedeCMS sys_safe.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-4593 CVE record

CVSS 4.3 Medium

DedeCMS sys_multiserv.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-4592 CVE record

CVSS 4.3 Medium

DedeCMS sys_group_edit.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-4591 CVE record

CVSS 4.3 Medium

DedeCMS sys_group_add.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-4590 CVE record

CVSS 4.3 Medium

DedeCMS sys_info.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-4589 CVE record

CVSS 4.3 Medium

DedeCMS mytag_edit.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-4588 CVE record

CVSS 4.3 Medium

DedeCMS mytag_add.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-4587 CVE record

CVSS 4.3 Medium

DedeCMS tpl.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-4586 CVE record

CVSS 4.3 Medium

DedeCMS shops_delivery.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-4585 CVE record

CVSS 4.3 Medium

DedeCMS member_type.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2024
CVE-2024-3686 CVE record

CVSS 4.3 Medium

DedeCMS update_guide.php path traversal
- DedeCMS
- Path traversal
Not analysed yet 12 Apr 2024
CVE-2024-3685 CVE record

CVSS 6.3 Medium

DedeCMS stepselect_main.php sql injection
- DedeCMS
- SQL injection
Not analysed yet 12 Apr 2024
CVE-2024-3148 CVE record

CVSS 6.3 Medium

DedeCMS makehtml_archives_action.php sql injection
- DedeCMS
- SQL injection
Not analysed yet 2 Apr 2024
CVE-2024-3147 CVE record

CVSS 4.3 Medium

DedeCMS makehtml_map.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 2 Apr 2024
CVE-2024-3146 CVE record

CVSS 4.3 Medium

DedeCMS makehtml_rss_action.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 2 Apr 2024
CVE-2024-3145 CVE record

CVSS 4.3 Medium

DedeCMS makehtml_js_action.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 2 Apr 2024
CVE-2024-3144 CVE record

CVSS 4.3 Medium

DedeCMS makehtml_spec.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 2 Apr 2024
CVE-2024-3143 CVE record

CVSS 4.3 Medium

DedeCMS member_rank.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 2 Apr 2024
CVE-2024-2823 CVE record

CVSS 4.3 Medium

DedeCMS mda_main.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 22 Mar 2024
CVE-2024-2822 CVE record

CVSS 4.3 Medium

DedeCMS vote_edit.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 22 Mar 2024
CVE-2024-2821 CVE record

CVSS 4.3 Medium

DedeCMS friendlink_edit.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 22 Mar 2024
CVE-2024-2820 CVE record

CVSS 4.3 Medium

DedeCMS baidunews.php cross-site request forgery
- DedeCMS
- Cross-site request forgery (CSRF)
Not analysed yet 22 Mar 2024
CVE-2023-7212 CVE record

CVSS 4.7 Medium

DeDeCMS Backend file_class.php unrestricted upload
- DeDeCMS
- Unrestricted file upload
Not analysed yet 7 Jan 2024
CVE-2023-5301 CVE record

CVSS 4.7 Medium

DedeCMS album_add.php AddMyAddon os command injection
- DedeCMS
- Command injection
Not analysed yet 30 Sept 2023
CVE-2023-5022 CVE record

CVSS 5.5 Medium

DedeCMS select_templets_post.php absolute path traversal
- DedeCMS
- Path traversal
Not analysed yet 17 Sept 2023
CVE-2023-4747 CVE record

CVSS 6.3 Medium

DedeCMS tags.php sql injection
- DedeCMS
- SQL injection
Not analysed yet 4 Sept 2023
CVE-2023-3578 CVE record

CVSS 5.5 Medium

DedeCMS co_do.php server-side request forgery
- DedeCMS
- Server-side request forgery (SSRF)
Not analysed yet 10 Jul 2023
CVE-2023-2928 CVE record

CVSS 6.3 Medium

DedeCMS article_allowurl_edit.php code injection
- DedeCMS
- Code injection
Not analysed yet 27 May 2023
CVE-2023-2424 CVE record

CVSS 6.3 Medium

DedeCMS config.php UpDateMemberModCache unrestricted upload
- DedeCMS
- Unrestricted file upload
Not analysed yet 29 Apr 2023
CVE-2023-2059 CVE record

CVSS 4.3 Medium

DedeCMS select_templets.php path traversal
- DedeCMS
- CWE-28
Not analysed yet 14 Apr 2023
CVE-2023-2056 CVE record

CVSS 6.3 Medium

DedeCMS module_main.php GetSystemFile code injection
- DedeCMS
- Code injection
Not analysed yet 14 Apr 2023