CVE-2023-40874

MediumCVSS 5.4

Published: 24/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

30th percentile - higher than 30% of all known CVEs

Summary

DedeCMS versions up to and including 5.7.110 were found to contain multiple cross-site scripting (XSS) vulnerabilities in /dede/vote_add.php triggered by the votename and voteitem1 parameters.

Risk Assessment

Exploitation of these vulnerabilities could lead to user data theft or session hijacking, posing a significant threat to the application's security and the organization's data.

Recommendation

It is recommended to update DedeCMS to the latest version to eliminate these vulnerabilities and conduct a security audit of the application.

Original NVD description (English source)

DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_add.php via the votename and voteitem1 parameters.