CVE-2018-18608

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-10-23 · updated 2026-06-17
Weakness: CWE-79

Description

DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATH_INFO to /member/index.php, /member/pm.php, /member/content_list.php, or /plus/feedback.php.

Affected products

DedeCMS: 5.7-sp2

References

https://github.com/ky-j/dedecms/files/2504649/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7.SP2.docx
https://github.com/ky-j/dedecms/issues/8
https://github.com/ky-j/dedecms/files/2504649/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7.SP2.docx
https://github.com/ky-j/dedecms/issues/8

Get alerted when CVE-2018-18608 or the next vulnerability affects your stack