CVE-2021-48016Critical· 9.8▾ MidnightDedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
DedeCMS <= 5.8.1-betaRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-94004High· 7.3A vulnerability was found in DedeCMS up to 5.7.118
CVE-2014-125131Medium· 6.1DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php
CVE-2025-11905Medium· 6.3A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2
CVE-2025-14730Medium· 4.7A security flaw has been discovered in CTCMS Content Management System up to 2.1.2
CVE-2025-14729Medium· 4.7A vulnerability was identified in CTCMS Content Management System up to 2.1.2
CVE-2025-10097Medium· 6.3A vulnerability was identified in SimStudioAI sim up to 1.0.0