Vulnerabilidades de Dedecms
CVEs publicadas que afetam produtos de Dedecms: 5 registro(s), com severidade, exploração e correções.
CVE-2026-30643
Crítica · 9.8
CWE-94 01/04/2026
Code Injection em Dedecms
An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.
CVE-2026-29839
Alta · 8.8
CWE-352 24/03/2026
Cross-Site Request Forgery (CSRF) em Dedecms
DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.
CVE-2026-30694
Crítica · 9.8
CWE-94 19/03/2026
Code Injection em Dedecms
An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component
CVE-2024-30855
Alta · 8.8
CWE-352 29/12/2025
Cross-Site Request Forgery (CSRF) em Dedecms
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.
CVE-2025-15004
Alta · 8.8
CWE-74 21/12/2025
DedeCMS freelist_main.php sql injection
A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation of the argument orderby leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.