CVE-2026-15533
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A security flaw was discovered in DedeCMS 5.7.118 in the file /plus/search.php within the Column Management component. Manipulating the Column Name argument allows remote code injection. The exploit has been publicly released and may be used in attacks.
Risk Assessment
An attacker can remotely execute arbitrary code on the server, leading to full system compromise, data theft, or website takeover.
Recommendation
Immediately update DedeCMS to the latest version or apply the available patch. If updating is not possible, temporarily disable the Column Management feature.
Other vulnerabilities in DedeCMS
See all- CVE-2017-17727High
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
- CVE-2026-38615Critical
A command execution vulnerability in DedeCMS V5.7.118 in file_manage_control.php allows an attacker to execute arbitrary commands on the server.
- CVE-2023-34842Critical
Remote Code Execution vulnerability in DedeCMS through version 5.7.109 allows an attacker to execute arbitrary code via a crafted POST request to /dede/tpl.php.
- CVE-2023-37839Critical
DedeCMS v5.7.109 has an arbitrary file upload vulnerability in /dede/file_manage_control.php that allows attackers to execute arbitrary code by uploading a crafted PHP file.
- CVE-2017-17731Critical
DedeCMS through 5.7 is vulnerable to SQL Injection via the $_FILES superglobal in plus/recommend.php.
- CVE-2017-17730Critical
DedeCMS versions up to 5.7 are vulnerable to SQL Injection via the logo parameter in plus/flink_add.php.
- CVE-2026-76800Medium
A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used.
- CVE-2026-76783High
A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-19353Medium
A vulnerability was found in DedeCMS up to version 5.7.118 UTF8SP2, leading to file inclusion in the _4_Setup function of the file install/index.php in the Installation Wizard component. The attack can be executed remotely but is characterized by high complexity and difficult exploitability. The exploit has been publicly disclosed.
- CVE-2026-15700Medium
A path traversal vulnerability has been discovered in DedeCMS 5.7.118 in the ExtractFile function of include/zip.class.php, used in the Album Publishing Feature. Manipulation of the filename argument allows remote exploitation.
Original NVD description (English source)
A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a manipulation of the argument Column Name results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.