QwikSec

Security Database

CVE

CWE

Training

CVE-2018-18608

Published: Oct 23, 2018

Modified: Sep 16, 2024

PUBLISHED

Description

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/ky-j/dedecms/files/2504649/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7.SP2.docx

x_refsource_MISC

https://github.com/ky-j/dedecms/issues/8

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.