Filtered by vendor Dedecms
Subscriptions
Total
93 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-36495 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 6.1 Medium |
| DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `filename`, `mid`, `userid`, and `templet' parameters. | ||||
| CVE-2020-36497 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 6.1 Medium |
| DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`, `userid`, and `templet' parameters. | ||||
| CVE-2020-36493 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 5.4 Medium |
| DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component media_main.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters. | ||||
| CVE-2020-36492 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 5.4 Medium |
| DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component select_media.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters. | ||||
| CVE-2020-27533 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 5.4 Medium |
| A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages. | ||||
| CVE-2020-23046 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 6.1 Medium |
| DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`, `mid`, `userid`, and `templet' parameters. | ||||
| CVE-2020-23044 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 5.4 Medium |
| DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic_view.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters. | ||||
| CVE-2020-22198 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 9.8 Critical |
| SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php. | ||||
| CVE-2020-18917 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 8.8 High |
| The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control. | ||||
| CVE-2020-18114 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 9.8 Critical |
| An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format. | ||||
| CVE-2020-16632 | 1 Dedecms | 1 Dedecms | 2024-08-04 | 5.4 Medium |
| A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter. | ||||
| CVE-2021-32073 | 1 Dedecms | 1 Dedecms | 2024-08-03 | 8.8 High |
| DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution. | ||||
| CVE-2022-48140 | 1 Dedecms | 1 Dedecms | 2024-08-03 | 5.4 Medium |
| DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename. | ||||
| CVE-2022-46442 | 1 Dedecms | 1 Dedecms | 2024-08-03 | 9.8 Critical |
| dedecms <=V5.7.102 is vulnerable to SQL Injection. In sys_ sql_ n query.php there are no restrictions on the sql query. | ||||
| CVE-2022-43031 | 1 Dedecms | 1 Dedecms | 2024-08-03 | 8.8 High |
| DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords. | ||||
| CVE-2022-43192 | 1 Dedecms | 1 Dedecms | 2024-08-03 | 6.7 Medium |
| An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is related to an incomplete fix for CVE-2022-40886. | ||||
| CVE-2022-40886 | 1 Dedecms | 1 Dedecms | 2024-08-03 | 7.2 High |
| DedeCMS 5.7.98 has a file upload vulnerability in the background. | ||||
| CVE-2022-40921 | 1 Dedecms | 1 Dedecms | 2024-08-03 | 7.2 High |
| DedeCMS V5.7.99 was discovered to contain an arbitrary file upload vulnerability via the component /dede/file_manage_control.php. | ||||
| CVE-2022-36583 | 1 Dedecms | 1 Dedecms | 2024-08-03 | 6.1 Medium |
| DedeCMS V5.7.97 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/co_do.php via the dopost, rpok, and aid parameters. | ||||
| CVE-2022-36216 | 1 Dedecms | 1 Dedecms | 2024-08-03 | 7.2 High |
| DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php. | ||||