Dedecms Dedecms vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Dedecms Dedecms: 5 record(s), with affected versions and fixes.
cpe:2.3:a:dedecms:dedecms

CVE-2026-30643 Critical · 9.8 CWE-94 Apr 1, 2026

Code Injection in Dedecms

An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.

CVE-2026-29839 High · 8.8 CWE-352 Mar 24, 2026

Cross-Site Request Forgery (CSRF) in Dedecms

DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.

CVE-2026-30694 Critical · 9.8 CWE-94 Mar 19, 2026

Code Injection in Dedecms

An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component

CVE-2024-30855 High · 8.8 CWE-352 Dec 29, 2025

Cross-Site Request Forgery (CSRF) in Dedecms

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.

CVE-2025-15004 High · 8.8 CWE-74 Dec 21, 2025

DedeCMS freelist_main.php sql injection

A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation of the argument orderby leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.