DedeCMS EUVD-2026-109685

Exploitation targets the specific DedeCMS advertisement-rendering endpoint plus/ad_js.php and requires that this script be reachable over the network; the injection is triggered by manipulating the 'aid' request argument, which flows through the _RunMagicQuotes function in common.inc.php. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirement are needed, so default internet-exposed installations of DedeCMS 5.7.118 are at risk. The precise manipulation of 'aid' needed to achieve code injection is not described in the available sources. The principal limiting factors are version/product scope (confirmed only for DedeCMS 5.7.118) and the Low impact sub-scores, which suggest the achievable effect may be partial rather than full code execution.

This is a mid-tier risk that should be triaged on a routine schedule rather than treated as an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable flaw with low attack complexity, no attack requirements, no privileges, and no user interaction - meaning it is reachable by anonymous remote attackers against an exposed endpoint. However, the impact metrics are all Low (VC:L/VI:L/VA:L), which is unusual for a CWE-94 code-injection issue and is the main reason the score lands at 6.9 (Medium) rather than Critical; VulDB appears to have scoped the achievable impact as partial rather than full system compromise. The exploit-maturity metric is E:X (Not Defined), there is no CISA KEV listing, and no EPSS probability is supplied, so there is no positive signal of active or imminent exploitation; the vuln.today priority of 'this_month' is consistent with a patch-on-normal-cadence item. Note a tension in the data: the Tags assert 'RCE' and the CWE is code injection (CWE-94), which normally implies arbitrary code execution and high integrity/availability impact, yet the CVSS impact sub-scores are only Low - this disagreement should be resolved against the vendor/VulDB detail before escalating, as the true impact may be higher than the numeric score suggests. All intelligence here originates from a single source (VulDB), so independent corroboration is absent.

A remote, unauthenticated attacker sends a crafted HTTP request to the public plus/ad_js.php advertisement-rendering endpoint, supplying a malicious value in the 'aid' parameter that is mishandled by the _RunMagicQuotes routine in common.inc.php, resulting in code injection (CWE-94). No user interaction or prior authentication is required per the CVSS 4.0 vector (PR:N/UI:N). No public exploit identified at time of analysis; the only references are VulDB catalog and submission pages, not verified working exploit code.