CVE Tools
Track your stack

Dedecms

167 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Dedecms, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Dedecms CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Dedecms CVEs per month
MonthCVEs
2024-111
2024-124
2025-010
2025-021
2025-030
2025-040
2025-051
2025-061
2025-070
2025-080
2025-090
2025-100
2025-110
2025-122
2026-010
2026-020
2026-032
2026-041
2026-050
2026-060
2026-070
2026-080
2026-090
2026-102

Severity

How the 167 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2414%
  • High4125%
  • Medium9758%
  • Low53%

Latest CVEs

The 15 most recently published vulnerabilities affecting Dedecms.

  1. CVE-2021-48016DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php9.8
  2. CVE-2014-125131DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php6.1
  3. CVE-2026-30643An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.9.8
  4. CVE-2026-29839DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.8.8
  5. CVE-2026-30694An issue in DedeCMS v.5.7.118 and before allows a remote attacker to execute arbitrary code via the array_filter component9.8
  6. CVE-2024-30855DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.8.8
  7. CVE-2025-15004DedeCMS freelist_main.php sql injection6.3
  8. CVE-2025-6335DedeCMS Template dedetag.class.php command injection4.7
  9. CVE-2025-5137DedeCMS Incomplete Fix CVE-2018-9175 sys_verifies.php code injection4.7
  10. CVE-2024-57241Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirection.6.5
  11. CVE-2024-12183DedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scripting3.5
  12. CVE-2024-12182DedeCMS soft_add.php cross site scripting3.5
  13. CVE-2024-12181DedeCMS SWF File uploads_add.php cross site scripting3.5
  14. CVE-2024-12180DedeCMS article_add.php cross site scripting3.5
  15. CVE-2024-11138DedeCMS friendlink_add.php unrestricted upload2.7

Product grouping is registry-driven, with AI assist and human review. How it works