DedeCMS CVE-2026-10606

Q: What is the CVSS score of CVE-2026-10606?

CVE-2026-10606 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33981 MEDIUM

SQL Injection (CWE-89)

2026-06-02 VulDB

GHSA-9rrw-qcf5-q3pr

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 17:33 vuln.today

Severity Changed

Jun 02, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Jun 02, 2026 - 17:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in DedeCMS 5.7.88 exposes the feedback submission endpoint to unauthenticated remote attackers who can manipulate the msg parameter passed to the TrimMsg function in /plus/feedback.php. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms no authentication or user interaction is required, and the E:P modifier indicates exploit code has been publicly disclosed per VulDB submission 829413. No CISA KEV listing was identified at time of analysis, but the combination of unauthenticated network access and a public POC elevates practical risk above the moderate base score of 5.5.

Technical ContextAI

DedeCMS is a PHP-based content management system widely deployed in Chinese-language web environments. The vulnerability resides in the TrimMsg function within /plus/feedback.php, the user-facing feedback submission handler. CWE-89 (Improper Neutralization of Special Elements in SQL Commands) identifies the root cause as unsanitized user input being incorporated directly into SQL query construction without parameterized queries or adequate escaping. The msg argument - submitted via the feedback form - is the injection point. The CPE string cpe:2.3:a:n/a:dedecms:*:*:*:*:*:*:*:* does not constrain the version beyond what the description states (5.7.88), and the PHP tag confirms the server-side language context.

RemediationAI

No vendor-released patch has been identified from available references - patch availability is unknown and should be monitored via VulDB at https://vuldb.com/vuln/367913 and the official DedeCMS project channels. If source-level access is available, apply parameterized queries or prepared statements to the msg parameter within the TrimMsg function in /plus/feedback.php to eliminate the injection surface. As an immediate compensating control, restrict or disable public access to the /plus/feedback.php endpoint via web server configuration (e.g., nginx location /plus/feedback.php { deny all; } or Apache <Files feedback.php> Require all denied </Files>) - note this disables the feedback submission feature entirely. Alternatively, deploy a web application firewall rule targeting SQL metacharacter patterns (quotes, comment sequences, UNION/SELECT keywords) in the msg parameter to reduce exploitation risk without removing functionality, though WAF bypass remains possible. Upgrade to a patched DedeCMS version as soon as one is made available.