{"id":"CVE-2026-116253","kind":"vulnerability","aliases":["CVE-2026-116253"],"related":[],"title":"DedeCMS: advertisement renderer lets remote attackers inject code via aid","description":"A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.","summary":"DedeCMS 5.7.118 has a flaw in plus/ad_js.php where the aid argument is not handled safely, enabling code injection. Per the NVD entry, an attacker can trigger it remotely.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dedecms","other","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Confirm the installed DedeCMS version with the site's admin panel or the version file; `unknown` if the sources do not say where it is stored\n- Check whether plus/ad_js.php is reachable from the internet on your server","fix":"- Upgrade DedeCMS to a release later than `5.7.118`; `unknown` if the sources name a fixed version\n- Restrict or remove access to plus/ad_js.php until patched","status":"open","published_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","triaged_at":"2026-10-26T10:30:46+00:00","updated_at":"2026-10-26T10:30:46+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-26T10:30:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade DedeCMS to a release later than `5.7.118`; `unknown` if the sources name a fixed version\n- Restrict or remove access to plus/ad_js.php until patched","reach":"internet","title":"DedeCMS: advertisement renderer lets remote attackers inject code via aid","impact":"high","summary":"DedeCMS 5.7.118 has a flaw in plus/ad_js.php where the aid argument is not handled safely, enabling code injection. Per the NVD entry, an attacker can trigger it remotely.","category":"other","nicknames":[],"who_cares":["dedecms","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker injects code that runs on the web server","analyst_note":"Sources give only the NVD entry; check the NVD page and any vendor or exploit write-up for the fixed version and whether authentication is needed.","how_to_check":"- Confirm the installed DedeCMS version with the site's admin panel or the version file; `unknown` if the sources do not say where it is stored\n- Check whether plus/ad_js.php is reachable from the internet on your server","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running DedeCMS 5.7.118 that expose plus/ad_js.php to the internet are exposed, since the flaw is reachable remotely through the aid argument. Sites on other DedeCMS versions or without this file reachable from outside are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00061,"input_tokens":3309,"output_tokens":559,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116253':13A,16A '-2026':12A,15A '5.7.118':24B,57C 'advertis':2A,72C 'affect':60C 'aid':10A,32B,80C 'argument':33B,79C 'attack':6A,46B,87C 'code':8A,39B,84C 'common.inc.php':63C 'compon':71C 'cve':11A,14A 'dedecm':1A,17B,23B,56C 'determin':54C 'enabl':38B 'entri':44B 'execut':74C,90C 'file':67C 'flaw':27B 'function':62C 'handl':36B 'host':22B 'inject':7A,40B,85C 'lead':82C 'let':4A 'manipul':76C 'nvd':43B 'per':41B 'php':19B 'plus/ad_js.php':29B,68C 'remot':5A,50B,91C 'render':3A,73C 'runmagicquot':64C 'safe':37B 'self':21B 'self-host':20B 'trigger':48B 'via':9A 'vulner':52C,59C","nicknames":[],"mitigations":[],"who_affected":"Sites running DedeCMS 5.7.118 that expose plus/ad_js.php to the internet are exposed, since the flaw is reachable remotely through the aid argument. Sites on other DedeCMS versions or without this file reachable from outside are not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T10:16:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116253","severity":null,"published_at":"2026-10-26T10:16:52+00:00","modified_at":"2026-10-26T10:16:52+00:00","first_seen_at":"2026-10-26T10:29:17+00:00","fetched_at":"2026-10-26T10:29:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}