CVE-2026-10607

HighCVSS 7.3/10Last modified Jul 22, 2026

Description

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dede_htmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
n/a	DedeCMS	5.7.88

References

Timeline

Published: Jun 2, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1060703.7A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central CVE-2026-1060713.6A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--all CVE-2026-1060726.7A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects CVE-2026-1060733.3A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an CVE-2026-1060744.8A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt(CVE-2026-1060769.0A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backu CVE-2026-1060778.3A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with CVE-2026-1060786.9A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses CVE-2026-1060798.8An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Netw CVE-2026-106087.3A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulat CVE-2026-1060878.7TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitra CVE-2026-1060898.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre