Code Injection Vulnerability in DedeCMS by Shanghai Zhuozhuo Network Technology
CVE-2026-116253

6.9MEDIUM

Key Information:

Vendor

Shanghai Zhuozhuo Network Technology Co.,Ltd.

Status
Dedecms
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116253?

A code injection vulnerability has been identified in DedeCMS version 5.7.118, affecting the advertisement rendering component within the file plus/ad_js.php. This issue arises due to improper handling of the argument aid in the function common.inc.php::_RunMagicQuotes, which could allow an attacker to execute arbitrary code remotely. It is essential for users of DedeCMS to review their implementations and apply necessary security measures to mitigate the risk associated with this vulnerability.

Affected Version(s)

DedeCMS 5.7.118

References

https://vuldb.com/vuln/426287
vdb-entrytechnical-description
https://vuldb.com/vuln/426287/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116253
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tiran (VulDB User)
VulDB Vulnerability Moderation Team
.