Live › vulnerability › CVE-2026-116253
Go to dashboardDedeCMS 5.7.118 has a flaw in plus/ad_js.php where the aid argument is not handled safely, enabling code injection. Per the NVD entry, an attacker can trigger it remotely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 10:29 UTC. All times on this page are UTC.
Sites running DedeCMS 5.7.118 that expose plus/ad_js.php to the internet are exposed, since the flaw is reachable remotely through the aid argument. Sites on other DedeCMS versions or without this file reachable from outside are not described as affected by the sources.
No product ranges from the sources yet.
unknown if the sources do not say where it is stored5.7.118; unknown if the sources name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.
This page as .md · .json · in your agent: get_signal("CVE-2026-116253")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.