What’s Vulnerable › Vulnerabilities
CVE-2018-10375
- Severity: critical (CVSS 9.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-04-25 · updated 2026-06-17
- Weakness: CWE-434
Description
A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to upload and execute arbitrary PHP code via the /dede/archives_do.php?dopost=uploadLitpic litpic parameter when "Content-Type: image/jpeg" is sent, but the filename ends in .php and contains PHP code.
Affected products
- DedeCMS: 5.7-sp2
References
Get alerted when CVE-2018-10375 or the next vulnerability affects your stack