Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2783▼ 434 respecto a la semana anterior

Críticas / altas1335▼ 118 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)265▼ 243 respecto a la semana anterior

181 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2017-17730	Modificada	Crítica (9.8)	1.1%	—	Dedecms	18/12/2017	17/6/2026	DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.
CVE-2017-17727	Modificada	Alta (8.8)	1.5%	—	Dedecms	18/12/2017	17/6/2026	DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
CVE-2011-5200	Modificada	Alta (7.5)	2.4%	💥 Exploit	Dedecms	23/9/2012	16/6/2026	Multiple SQL injection vulnerabilities in DeDeCMS, possibly 5.6, allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) list.php, (2) members.php, or (3) book.php.
CVE-2010-1097	Modificada	Media (6.8)	1.4%	—	Dedecms	24/3/2010	16/6/2026	include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to uploads/include/dialog/select_soft_post.php.
CVE-2009-3806	Modificada	Alta (7.5)	2.6%	💥 Exploit	Dedecms	27/10/2009	16/6/2026	SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows remote attackers to execute arbitrary SQL commands via the arcurl parameter.
CVE-2009-2270	Modificada	Media (6.8)	1.8%	—	Dedecms	1/7/2009	16/6/2026	Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a file with a double extension in the filename, then accessing this file via unspecified vectors, as demonstrated by a .jpg.php filename.