Vulnerabilities > Dedecms
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-01-06 | CVE-2015-4553 | Unrestricted Upload of File with Dangerous Type vulnerability in Dedecms 5.5/5.6/5.7 A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. | 8.8 |
| 2019-03-24 | CVE-2019-10014 | Incorrect Authorization vulnerability in Dedecms 5.7 In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated. | 6.5 |
| 2019-02-19 | CVE-2019-8933 | Unrestricted Upload of File with Dangerous Type vulnerability in Dedecms 5.7 In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory (without being blocked by the Web Application Firewall), and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on New Template, and modifying the filename from ../index.html to ../index.php. | 8.8 |
| 2019-02-16 | CVE-2019-8362 | Unrestricted Upload of File with Dangerous Type vulnerability in Dedecms 5.5/5.6/5.7 DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" (because input validation only checks that .jpg, .png, or .gif is present as a substring, and does not otherwise check the file name or content). | 7.5 |
| 2019-01-15 | CVE-2019-6289 | Use of Incorrectly-Resolved Name or Reference vulnerability in Dedecms 5.7 uploads/include/dialog/select_soft.php in DedeCMS V57_UTF8_SP2 allows remote attackers to execute arbitrary PHP code by uploading with a safe file extension and then renaming with a mixed-case variation of the .php extension, as demonstrated by the 1.pHP filename. | 8.8 |
| 2018-12-13 | CVE-2018-20129 | Code Injection vulnerability in Dedecms 5.7 An issue was discovered in DedeCMS V5.7 SP2. | 8.8 |
| 2018-11-07 | CVE-2018-19061 | SQL Injection vulnerability in Dedecms 5.7 DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter. | 9.8 |
| 2018-10-29 | CVE-2018-18782 | Cross-site Scripting vulnerability in Dedecms 5.7 Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter. | 6.1 |
| 2018-10-29 | CVE-2018-18781 | Cross-site Scripting vulnerability in Dedecms 5.7 DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter. | 6.1 |
| 2018-10-23 | CVE-2018-18608 | Cross-site Scripting vulnerability in Dedecms 5.7 DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php. | 6.1 |