How many CVEs does dedecms have?

dedecms has 177 published CVE records since 2009, including 18 in the last two years.

How many dedecms CVEs are in CISA KEV?

None of dedecms's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which dedecms products have the most CVEs?

The dedecms products with the most published CVEs are DedeCMS, DedeCMS 5.7.

What are the most common weakness types in dedecms CVEs?

dedecms's CVEs most often map to these CWE weakness types: CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).

Are there public exploits for dedecms vulnerabilities?

Yes — 159 of dedecms's CVEs have a known public exploit.

How many critical dedecms vulnerabilities are there?

dedecms has 28 critical and 47 high-severity CVEs.

What is the average severity of dedecms CVEs?

The average CVSS base score across dedecms's scored CVEs is 6.9.

RadicalNotion.AI

Log in Create an account

177 CVEs

dedecms Vulnerabilities

Name: dedecms vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for dedecms.

177

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

159

Public exploits

PoC or exploit code

6.9

Avg CVSS

2009–2026

Overview

dedecms has 177 published CVE records since 2009, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 159 have a known public exploit. The average CVSS base score across scored CVEs is 6.9.

Security scorecard

A quick read on dedecms's vulnerability posture, as a share of its 177 published CVEs.

Average CVSS: 6.9
Critical / high: 42%
Actively exploited (KEV): 0%
Public exploit available: 90%
Patch available: 5%

Severity and exploitation

How the CVSS severity of dedecms's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical28

High47

Medium101

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of dedecms's CVEs are currently listed in CISA's KEV catalog.

Public exploits

159

159 of dedecms's CVEs have a known public exploit available.

Most affected products

The dedecms products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in dedecms CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish dedecms CVE records.

Disclosure activity by year

How many dedecms CVEs were published each year.

2019

4

2020

2

2021

15

2022

11

2023

28

2024

73

2025

5

2026

13

Latest dedecms CVEs

The most recently disclosed vulnerabilities affecting dedecms.

DedeCMS mytag_js.php code injection
CWE-94
Medium · CVSS 6.9
EPSS 0.5%2026-09-20
DeDeCMS select_media_post.php unrestricted upload
CWE-434
Medium · CVSS 5.3
EPSS 0.3%2026-08-20
DeDeCMS advancedsearch.php sql injection
CWE-89
Medium · CVSS 6.9
EPSS 0.4%2026-08-20
DedeCMS Installation Wizard index.php _4_Setup file inclusion
CWE-73
Low · CVSS 2.3
EPSS 0.4%2026-08-09
DedeCMS Album Publishing Feature zip.class.php ExtractFile path traversal
CWE-22
Medium · CVSS 5.1
EPSS 0.5%2026-07-14
DedeCMS Column Management search.php code injection
CWE-94
Medium · CVSS 5.1
EPSS 0.4%2026-07-13
DedeCMS carbuyaction.php RemoveXSS sql injection
CWE-74
Medium · CVSS 6.9
EPSS 0.3%2026-06-02
DedeCMS flink.php dede_htmlspecialchars sql injection
CWE-89
Medium · CVSS 6.9
EPSS 0.3%2026-06-02
DedeCMS Feedback feedback.php TrimMsg sql injection
CWE-89
Medium · CVSS 6.9
EPSS 0.3%2026-06-02
DedeCMS download.php base64_decode server-side request forgery
CWE-918
Medium · CVSS 5.3
EPSS 0.2%2026-06-02
Critical vulnerability · 2026-04-01
CWE-94
Critical · CVSS 9.8
EPSS 0.8%2026-04-01
High vulnerability · 2026-03-24
CWE-352
High · CVSS 8.8
EPSS 0.2%2026-03-24

Get an alert for each new dedecms CVE, with AI-written analysis and remediation steps.

Monitor dedecms CVEs

Other vendors

CVE counts for other vendors.

Cloud Foundry178 CVEs DrayTek177 CVEs MyBB177 CVEs OpenHarmony177 CVEs Sophos176 CVEs owncloud176 CVEs Kashipara176 CVEs MIT176 CVEs

Browse all vendors

Frequently asked questions

Common questions about dedecms vulnerabilities.

How many CVEs does dedecms have?: dedecms has 177 published CVE records since 2009, including 18 in the last two years.
How many dedecms CVEs are in CISA KEV?: None of dedecms's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which dedecms products have the most CVEs?: The dedecms products with the most published CVEs are DedeCMS, DedeCMS 5.7.
What are the most common weakness types in dedecms CVEs?: dedecms's CVEs most often map to these CWE weakness types: CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).
Are there public exploits for dedecms vulnerabilities?: Yes — 159 of dedecms's CVEs have a known public exploit.
How many critical dedecms vulnerabilities are there?: dedecms has 28 critical and 47 high-severity CVEs.
What is the average severity of dedecms CVEs?: The average CVSS base score across dedecms's scored CVEs is 6.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track dedecms vulnerabilities

Get an alert for each new dedecms CVE, with AI-written analysis and remediation steps.

Create an account See pricing