Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (175 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-6881 2 Dedecms, Phome 2 Dedecms, Empirecms 2024-11-21 5.3 Medium
EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.
CVE-2018-20129 1 Dedecms 1 Dedecms 2024-11-21 N/A
An issue was discovered in DedeCMS V5.7 SP2. uploads/include/dialog/select_images_post.php allows remote attackers to upload and execute arbitrary PHP code via a double extension and a modified ".php" substring, in conjunction with the image/jpeg content type, as demonstrated by the filename=1.jpg.p*hp value.
CVE-2018-19061 1 Dedecms 1 Dedecms 2024-11-21 N/A
DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter.
CVE-2018-18782 1 Dedecms 1 Dedecms 2024-11-21 N/A
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter.
CVE-2018-18781 1 Dedecms 1 Dedecms 2024-11-21 N/A
DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.
CVE-2018-18608 1 Dedecms 1 Dedecms 2024-11-21 N/A
DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php.
CVE-2018-18579 1 Dedecms 1 Dedecms 2024-11-21 N/A
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter.
CVE-2018-18578 1 Dedecms 1 Dedecms 2024-11-21 N/A
DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter.
CVE-2018-16786 1 Dedecms 1 Dedecms 2024-11-21 N/A
DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php.
CVE-2018-16785 1 Dedecms 1 Dedecms 2024-11-21 N/A
XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell
CVE-2018-16784 1 Dedecms 1 Dedecms 2024-11-21 N/A
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.
CVE-2018-12046 1 Dedecms 1 Dedecms 2024-11-21 N/A
DedeCMS through 5.7SP2 allows arbitrary file write in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=newfile request with name and str parameters, as demonstrated by writing to a new .php file.
CVE-2018-12045 1 Dedecms 1 Dedecms 2024-11-21 N/A
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file.
CVE-2018-10375 1 Dedecms 1 Dedecms 2024-11-21 N/A
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename ends in .php and contains PHP code.
CVE-2015-4553 1 Dedecms 1 Dedecms 2024-11-21 8.8 High
A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.