CVE-2023-5301

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in DedeCMS 5.7.111. This vulnerability affects the function AddMyAddon of the file album_add.php. The manipulation of the argument albumUploadFiles leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240940.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Sep 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-530105.5In the Linux kernel, the following vulnerability has been resolved: bnxt: Do not read past the end of test names Test names were being conCVE-2023-530115.5In the Linux kernel, the following vulnerability has been resolved: net: stmmac: enable all safety features by default In the original impCVE-2023-530125.5In the Linux kernel, the following vulnerability has been resolved: thermal: core: call put_device() only after device_register() fails puCVE-2023-530135.5In the Linux kernel, the following vulnerability has been resolved: ptdma: pt_core_execute_cmd() should use spinlock The interrupt handlerCVE-2023-530145.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix memory leak in terminate_all() Terminate vdesc wCVE-2023-530155.5In the Linux kernel, the following vulnerability has been resolved: HID: betop: check shape of output reports betopff_init() only checks tCVE-2023-530165.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix possible deadlock in rfcomm_sk_state_change syzbot repoCVE-2023-530175.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() When hciCVE-2023-530185.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leaks When hci_cmd_sync_queue() failedCVE-2023-530197.8In the Linux kernel, the following vulnerability has been resolved: net: mdio: validate parameter addr in mdiobus_get_phy() The caller mayCVE-2023-53025.4A vulnerability, which was classified as problematic, has been found in SourceCodester Best Courier Management System 1.0. This issue affectCVE-2023-530204.7In the Linux kernel, the following vulnerability has been resolved: l2tp: close all race conditions in l2tp_tunnel_register() The code in
CVE-2023-5301: High severity, CVSS 8.8 | Vulnix