DedeCMS vendor intelligence

DedeCMS Known Exploited Vulnerabilities

Track evidence-backed exploitation affecting DedeCMS products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.

Browse KEV feed
Total KEVs
4
Known exploited vulnerabilities affecting DedeCMS products
In CISA KEV
0
Records also listed in the official catalog
Beyond CISA KEV
4
Additional exploited vulnerabilities absent from CISA KEV
Sensor Observed
0
DedeCMS KEVs with sensor-observed exploitation activity

The catalog gap matters for DedeCMS exposure

All four exploited DedeCMS vulnerabilities tracked by Previdian are not in CISA KEV. Teams relying on the official catalog alone would miss 100% of this vendor portfolio.

0%
Covered by CISA
100%
Beyond CISA
3
Product families

Attested DedeCMS vulnerabilities

4 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.

How exploitation is verified
CVE / description Product Confidence CISA KEV Added
CVE-2021-48016

DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php

 DedeCMS High Beyond CISA 22 Oct 2026
CVE-2014-125131

DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php

 DedeCMS High Beyond CISA 20 Oct 2026
CVE-2017-17731

DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.

 Dedecms High Beyond CISA 14 Sep 2026
CVE-2018-7700

DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a...

 DedeCMS 5.7 High Beyond CISA 27 Mar 2018

Showing 4 of 4 on this page (4 DedeCMS known exploited vulnerabilities).

Recurring weakness patterns

Cross-site request forgery (csrf), neutralization, and neutralization account for three mapped occurrences across this DedeCMS KEV portfolio.

Browse all KEVs →

CWE-352

Cross-Site Request Forgery (CSRF)

1

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

1

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

1

CWE-94

Improper Control of Generation of Code ('Code Injection')

1