CVE-2026-15533

MEDIUM 4.7

DedeCMS Column Management search.php code injection

CVSS Score

4.7

EPSS Score

0.2%

EPSS Percentile

16th

A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a manipulation of the argument Column Name results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

CWE	CWE-94 CWE-74
Vendor	n/a
Product	dedecms
Published	Jul 13, 2026
Last Updated	Jul 13, 2026

Stay Ahead of the Next One

Get instant alerts for n/a dedecms

Be the first to know when new medium vulnerabilities affecting n/a dedecms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / DedeCMS

5.7.118

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/377878 vuldb.com: https://vuldb.com/vuln/377878/cti vuldb.com: https://vuldb.com/cve/CVE-2026-15533 vuldb.com: https://vuldb.com/submit/854988 vuldb.com: https://vuldb.com/submit/854989 github.com: https://github.com/DunkBoyZz/cve/blob/cb7d6aa088d5ae4b603399af0a3279c18b084f11/DedeCMS%20V5.7.118%20Column%20Name%20Cache%20File%20Writing%20RCE%20Vulnerability.docx

Credits

🔍 dunkboy (VulDB User)