DedeCMS CVE-2026-10608

Q: What is the CVSS score of CVE-2026-10608?

CVE-2026-10608 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33997 MEDIUM

SQL Injection (CWE-89)

2026-06-02 VulDB

GHSA-2wj9-543r-64gv

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 20:24 vuln.today

Severity Changed

Jun 02, 2026 - 20:22 NVD

HIGH MEDIUM

CVSS changed

Jun 02, 2026 - 20:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

DescriptionCVE.org

A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulation of the argument postname/des results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

SQL injection in DedeCMS 5.7.88 allows remote unauthenticated attackers to manipulate the database through the carbuyaction.php endpoint by supplying crafted postname or des parameter values that bypass the RemoveXSS sanitization function. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no special conditions are required for exploitation. A public proof-of-concept exploit has been released (CVSS E:P modifier), though no CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis.

Technical ContextAI

DedeCMS (织梦CMS) is a widely-deployed PHP-based content management system popular in Chinese-language web environments. The vulnerability resides in /plus/carbuyaction.php, a shopping cart action handler, within the RemoveXSS function - a routine designed to strip XSS payloads from user input. Despite its sanitization intent, the function fails to neutralize SQL metacharacters before the postname and des arguments are incorporated into database queries, a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) failure. The CPE identifier cpe:2.3:a:n/a:dedecms:*:*:*:*:*:*:*:* reflects the affected application but uses a wildcard version, meaning NVD CPE data does not independently constrain the affected version range beyond the CVE description's explicit reference to 5.7.88.

RemediationAI

No vendor-released patch has been identified at time of analysis from the available data - administrators should monitor VulDB at https://vuldb.com/vuln/367915 and the official DedeCMS project for an official fix. As an immediate compensating control, restrict public access to /plus/carbuyaction.php via web server configuration - for nginx, add a location block denying requests to this path; for Apache, use an .htaccess Deny directive - noting this will disable shopping cart submission functionality for end users. If the endpoint must remain accessible, deploy a web application firewall rule to detect and block SQL injection patterns in the postname and des POST parameters; be aware WAF rules require tuning to avoid false positives on legitimate cart submissions. Additionally, audit and restrict the DedeCMS database account to least-privilege permissions, removing any ability to access tables outside the application schema, which limits the data exposure achievable through a successful injection even if other controls fail.