CVE-2026-116253
Received Received - Intake

Code Injection in DedeCMS via Advertisement Rendering

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116253
EUVD
EUVD-2026-109685

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a DedeCMS 5.7.118

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in DedeCMS version 5.7.118. It involves a code injection flaw in the function common.inc.php::_RunMagicQuotes within the plus/ad_js.php file. The issue arises when the argument 'aid' is manipulated, allowing an attacker to inject malicious code remotely.

Detection Guidance

To detect this vulnerability, inspect the plus/ad_js.php file in DedeCMS 5.7.118 for the _RunMagicQuotes function. Look for improper handling of the aid argument which may indicate code injection attempts. Monitor network traffic for unusual requests targeting this file.

Impact Analysis

An attacker could exploit this to execute arbitrary code on the server running DedeCMS. This may lead to unauthorized data access, modification, or deletion, potential defacement of the website, or further compromise of the hosting environment.

Mitigation Strategies

Immediately update DedeCMS to the latest patched version. If an update is unavailable, disable the plus/ad_js.php file or restrict access to it. Review server logs for signs of exploitation and remove any unauthorized code or files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart