CVE-2010-20125High· 7.5▾ MidnightPoC availableDedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attacke…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.6%
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
DedeCMS < 5.7Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116063Medium· 4.7DedeCMS update_guide.php require_once code injection
CVE-2021-48016Critical· 9.8DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
CVE-2026-94004High· 7.3A vulnerability was found in DedeCMS up to 5.7.118
CVE-2026-116253High· 7.3DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection
CVE-2014-125131Medium· 6.1DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php
CVE-2014-125137Medium· 6.5C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php