Live › vulnerability › CVE-2014-125131
Go to dashboardDedeCMS 5.6 and 5.7 does not sanitize the adminDirHand parameter on /include/dialog/config.php, so a crafted GET link breaks out of a generated script tag. A victim who opens the link runs attacker-supplied JavaScript in their browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running DedeCMS 5.6 or 5.7 that expose the /include/dialog/config.php endpoint. The attack needs a victim to open a crafted link, so administrators who browse the backend are the most exposed. Sites on other versions or with that file removed or blocked can skip it.
No product ranges from the sources yet.
5.6 or 5.7/include/dialog/config.php with an adminDirHand parameter containing script markup in a test environment only, and see whether it is echoed unescapedUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying unsanitized input to the adminDirHand parameter. Attackers can send crafted GET requests to /include/dialog/config.php that close the generated script tag and inject JavaScript, which executes in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
This page as .md · .json · in your agent: get_signal("CVE-2014-125131")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.