DedeCMS (5.7.118) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/dedecms-5.7.118/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 21:23:46 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDedeCMS: Code injection via Advertisement Rendering (CVE-2026-116253)https://feed.craftedsignal.io/briefs/2026-10-dedecms-code-injection-eff398ce/Thu, 29 Oct 2026 21:23:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-dedecms-code-injection-eff398ce/A code injection vulnerability in DedeCMS 5.7.118 allows for remote exploitation via the aid parameter in the Advertisement Rendering component.A vulnerability exists in DedeCMS 5.7.118 within the common.inc.php::_RunMagicQuotes function of the plus/ad_js.php file. The flaw affects the Advertisement Rendering component. Manipulating the aid argument can lead to code injection. The attack can be executed remotely.

]]>highadvisory