Code Injection Vulnerability in DedeCMS by Shanghai Zhuozhuo Network Technology
CVE-2026-94004

6.9MEDIUM

Key Information:

Vendor

Shanghai Zhuozhuo Network Technology

Status
Dedecms
Vendor
CVE Published:
20 September 2026

What is CVE-2026-94004?

A code injection vulnerability has been identified in DedeCMS versions up to 5.7.118. The flaw is located in an unknown function of the file plus/mytag_js.php, where manipulation of the 'aid' argument can lead to remote code execution. This vulnerability has been publicly disclosed and attackers could exploit it remotely to execute arbitrary code on the affected systems.

Affected Version(s)

DedeCMS 5.7.118

References

https://vuldb.com/vuln/407953
vdb-entrytechnical-description
https://vuldb.com/vuln/407953/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-94004
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

BlackSpdier (VulDB User)
VulDB Vulnerability Moderation Team
.