DedeCMS CVE-2026-10607

Q: What is the CVSS score of CVE-2026-10607?

CVE-2026-10607 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33995 MEDIUM

SQL Injection (CWE-89)

2026-06-02 VulDB

GHSA-g8rg-9wq4-r9pr

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 20:25 vuln.today

Severity Changed

Jun 02, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Jun 02, 2026 - 20:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dede_htmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in DedeCMS 5.7.88 allows remote unauthenticated attackers to manipulate database queries via the msg parameter in /plus/flink.php, where the dede_htmlspecialchars function fails to adequately sanitize input before use in SQL operations. The CVSS 4.0 vector confirms no authentication, no user interaction, and low complexity - making this trivially reachable over the network. Publicly available exploit code exists (CVSS E:P), though no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

Technical ContextAI

DedeCMS (DedeCMS/Dedecool) is a widely deployed PHP-based content management system popular in Chinese-language web deployments. The vulnerable component is /plus/flink.php, a friend-link management endpoint, where the function dede_htmlspecialchars is used to process user-supplied input from the msg parameter. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that the function does not correctly escape or parameterize the input before it is incorporated into a SQL query, allowing an attacker to inject arbitrary SQL syntax. The CPE entry cpe:2.3:a:n/a:dedecms:*:*:*:*:*:*:*:* does not constrain the affected version range beyond what the description specifies (5.7.88), and no upstream vendor CPE authority is registered. The PHP tag indicates the attack surface is server-side, with the injection occurring within the application layer rather than the database engine itself.

RemediationAI

No vendor-released patch has been identified at time of analysis - affected version information derives solely from NVD/VulDB data with no corresponding vendor security advisory. As an immediate compensating control, restrict or disable public access to /plus/flink.php via web server configuration (e.g., deny access in Apache .htaccess or nginx location block); this eliminates the attack surface for this specific endpoint but may disable the friend-link submission feature for legitimate users. Additionally, deploy a web application firewall (WAF) rule to detect and block SQL injection patterns in the msg POST/GET parameter targeting this endpoint - note that WAF rules can be bypassed by advanced attackers and should not be treated as a permanent fix. Input validation at the application layer (parameterized queries or prepared statements replacing dede_htmlspecialchars) represents the correct long-term remediation. Monitor VulDB (https://vuldb.com/vuln/367914) and the official DedeCMS release channel for patch availability. Until a confirmed patched version is released, assume the risk is unmitigated at the code level.