Is there a public PoC exploit available for CVE-2026-15533?

Yes, a public proof-of-concept exploit is available for CVE-2026-15533. Prioritise patching immediately. EPSS: 0.2%.

DedeCMS CVE-2026-15533

Q: What is the CVSS score of CVE-2026-15533?

CVE-2026-15533 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43279 LOW

Code Injection (CWE-94)

2026-07-13 VulDB

GHSA-5jpp-cp4j-9m54

PHP RCE Code Injection Dedecms N A

2.0

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable but requires high-privilege admin auth (PR:H); code injection enabling PHP RCE justifies High C/I/A despite vendor's Low assignment.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 06:22 NVD

5.1 (MEDIUM) 2.0 (LOW)

Analysis Generated

Jul 13, 2026 - 05:52 vuln.today

DescriptionCVE.org

A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a manipulation of the argument Column Name results in code injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Code injection in DedeCMS 5.7.118 exposes high-privileged remote attackers to arbitrary PHP code execution via the Column Name parameter in the Column Management component of /plus/search.php. The exploit document on GitHub describes a cache file writing mechanism through which attacker-supplied input is persisted to disk and subsequently executed by the PHP runtime. A public proof-of-concept exists; no active exploitation is confirmed in the CISA KEV catalog.

Technical ContextAI

DedeCMS is a PHP-based content management system popular primarily in China. The vulnerable component is the Column Management feature, reachable through /plus/search.php. CWE-94 (Improper Control of Generation of Code / Code Injection) indicates that the Column Name argument is incorporated into dynamically generated or cached PHP content without adequate sanitization or escaping, enabling an attacker to inject arbitrary PHP expressions or statements. The exploit documentation title references 'Cache File Writing,' implying the application serializes column configuration into a PHP-interpretable cache file - a classic unsafe deserialization or template-write pattern. The CPE string cpe:2.3:a:n/a:dedecms:*:*:*:*:*:*:*:* reflects the NVD record, with version 5.7.118 explicitly named in the CVE description.

RemediationAI

No vendor-released patch has been identified at time of analysis; monitor VulDB (https://vuldb.com/vuln/377878) and DedeCMS official channels for a fix. As an immediate compensating control, restrict the DedeCMS administrative backend to trusted IP ranges using firewall rules or web server access controls - this directly neutralizes the PR:H requirement by preventing unauthorized admin sessions from reaching the endpoint, with no functional impact to end-users. Additionally, configure the web server to deny direct HTTP access to the cache directory, preventing cached PHP files from being served even if written. Enforce strong, unique credentials for all admin accounts and consider multi-factor authentication if the CMS plugin ecosystem supports it. Note that restricting cache directory write permissions at the OS level may disrupt CMS performance features.