An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.

Description

Vendor	Product	Versions
dedecms	dedecms	—

Tier C

VulDB3d ago

→ No new info (linked only)

CVSS 3.19.8 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

CWECWE-94

PublishedApr 1, 2026

Last enriched3d agov2

Trending Score18

Source articles1

Independent1

Info Completeness7/14

Missing: versions, epss, kev, exploit, patch, iocs, mitre_attack

0 upvotes0 downvotes

Last enriched 3d ago

v2Tier C3d ago

Added vendor DedeCMS and product Module Handler, and updated exploit availability to false.

vendorproduct

via VulDB

v13d ago

Initial creation