CVE-2020-18917

HIGH

dedecms 5.7 SP2 - Remote Code Execution via typename Parameter

Title source: llm
STIX 2.1

Description

The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control.

References (1)

Core 1

Scores

CVSS v3 8.8
EPSS 0.0020
EPSS Percentile 42.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
dedecms/dedecms 5.7 sp2
Published Aug 24, 2021
Tracked Since Feb 18, 2026