CVE-2024-6940CWE-94

DedeCMS article_template_rand.php code injection

Medium · published July 21, 2024

CVSS v4.0
5.1
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

A vulnerability was found in DedeCMS 5.7.114. It has been classified as critical. This affects an unknown part of the file article_template_rand.php. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271995. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00667 · 51.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-07-21T05:31Z
EPSS history
Timeline
  • 21 JUL 05:31Z
    DedeCMS article_template_rand.php code injection
    cvelistv5