CVE-2023-34842

CriticalCVSS 9.8

Published: 31/07/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.95%

57th percentile - higher than 57% of all known CVEs

Summary

Remote Code Execution vulnerability in DedeCMS through version 5.7.109 allows an attacker to execute arbitrary code via a crafted POST request to /dede/tpl.php.

Risk Assessment

An attacker can take over the server, steal data, or install malware, posing a critical threat to the confidentiality, integrity, and availability of the system.

Recommendation

Immediately update DedeCMS to the latest available version or apply the provided security patches. If an update is not possible, restrict access to the /dede/tpl.php script to trusted IP addresses only.

Original NVD description (English source)

Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /dede/tpl.php.