Sploitus

New CVE Exploits Affect DedeCMS with Remote Code Execution Vulnerability

First seen 25 Sep 2026, 06:26 UTC • •54.9

Article Content

1 / 4

Browse articles

ThreatCluster •September 26, 2026 at 05:24 UTC

•CVE-2026-XXXX allows remote code execution in DedeCMS.
•The vulnerability has a CVSS score of 7.2/8.8, indicating high severity.
•Proof-of-concept scripts are available but are non-weaponized.

A newly discovered vulnerability in DedeCMS (CVE-2026-XXXX) allows for remote code execution through the 'dede/update_guide.php' script. The vulnerability has a CVSS score of 7.2/8.8 and was disclosed on September 25, 2026. The affected version is DedeCMS V5.7.118, and the advisory includes non-weaponized proof-of-concept scripts for educational purposes. This vulnerability is significant as it could potentially allow attackers to execute arbitrary code on affected systems. The advisory emphasizes that the proof-of-concept scripts are for authorized testing only, and misuse is not condoned. Current status indicates that the vulnerability is now public, and organizations using DedeCMS should take immediate action to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 44d ago How this analysis works

Timeline

2026-09-25

CVE-2026-XXXX disclosed

DedeCMS vulnerability allows remote code execution through 'dede/update_guide.php'.

More articles in this cluster (3)

Threat Graph

11 entities, 18 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Vulnerability (5)

CVE-2021-44228
CVE-2023-23397
CVE-2024-3400
EternalBlue
Log4Shell

Weakness (2)

CWE-352 - Cross-Site Request Forgery (csrf)
CWE-94 - Code Injection

Affected Platform (1)

DedeCMS

Tool (2)

Metasploit
Nuclei

Relationships

Metasploit exploits CVE-2021-44228
Metasploit exploits CVE-2023-23397
Metasploit exploits CVE-2024-3400
Metasploit exploits EternalBlue
Metasploit exploits Log4Shell
Nuclei exploits CVE-2021-44228
Nuclei exploits CVE-2023-23397
Nuclei exploits CVE-2024-3400
Nuclei exploits EternalBlue
Nuclei exploits Log4Shell
CVE-2021-44228 targets DedeCMS
CVE-2023-23397 targets DedeCMS
CVE-2024-3400 targets DedeCMS
EternalBlue targets DedeCMS
Log4Shell targets DedeCMS
Zero-day Exploit targets DedeCMS
CVE-2021-44228 related to CWE-352 - Cross-Site Request Forgery (csrf)
CVE-2021-44228 related to CWE-94 - Code Injection

Following this threat?

Track CVE-2021-44228 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…

Log4Shell Vulnerability: Ongoing Risks and Mitigations CVE-2021-44228, known as Log4Shell, is a critical remote code execution vulnerability in Apache Log4j 2, disclosed on December 10, 2021. This flaw allows attackers to execute arbitrary code by manipulating log messages, affecting a wide range of applications and services that utilize Log4j. Despite being disclosed…