What’s Vulnerable › Vulnerabilities

CVE-2026-15533: DedeCMS Column Management search.php code injection

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-13 · updated 2026-07-13
• Weakness: CWE-74

Description

A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a manipulation of the argument Column Name results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Affected products

• DedeCMS: 5.7.118

References

• https://github.com/DunkBoyZz/cve/blob/cb7d6aa088d5ae4b603399af0a3279c18b084f11/DedeCMS%20V5.7.118%20Column%20Name%20Cache%20File%20Writing%20RCE%20Vulnerability.docx
• https://vuldb.com/cve/CVE-2026-15533
• https://vuldb.com/submit/854988
• https://vuldb.com/submit/854989
• https://vuldb.com/vuln/377878
• https://vuldb.com/vuln/377878/cti

Get alerted when CVE-2026-15533 or the next vulnerability affects your stack