CVE-2024-12181

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in DedeCMS 5.7.116. Affected by this vulnerability is an unknown functionality of the file /member/uploads_add.php of the component SWF File Handler. The manipulation of the argument mediatype leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
n/a	DedeCMS	5.7.116
dedecms	dedecms	5.7.116

References

https://github.com/Hebing123/cve/issues/77Exploit, Third Party Advisory
https://vuldb.com/?ctiid.286903Permissions Required
https://vuldb.com/?id.286903Third Party Advisory
https://vuldb.com/?submit.452983Third Party Advisory

Timeline

Published: Dec 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-121825.4A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.116. Affected by this issue is some unknown functionalit CVE-2024-121835.4A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/ca CVE-2024-121845.3The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check o CVE-2024-121857.8A vulnerability has been found in code-projects Hotel Management System 1.0 and classified as problematic. This vulnerability affects unknow CVE-2024-121867.8A vulnerability was found in code-projects Hotel Management System 1.0 and classified as problematic. This issue affects some unknown proces CVE-2024-121879.8A vulnerability was found in 1000 Projects Library Management System 1.0. It has been classified as critical. Affected is an unknown functio CVE-2024-121889.8A vulnerability was found in 1000 Projects Library Management System 1.0. It has been declared as critical. Affected by this vulnerability i CVE-2024-121896.4The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to S CVE-2024-12195.3The Easy Social Feed WordPress plugin before 6.5.6 does not validate and escape some of its shortcode attributes before outputting them bac CVE-2024-121904.3The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordP CVE-2024-121917.8A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor CVE-2024-121927.8A maliciously crafted DWF file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor m