DedeCMS EUVD-2026-83732

Requires an internet-reachable DedeCMS installation (version up to and including 5.7.118) with the plus/mytag_js.php script accessible; exploitation is remote and unauthenticated (PR:N) with no user interaction (UI:N), targeting the 'aid' request parameter. No special non-default configuration is stated as required. The main limiting factors are the constrained technical impact (vendor rated VC/VI/VA all Low, so this is unlikely to be full arbitrary code execution despite the RCE tag) and the requirement that the plus/ auxiliary scripts remain deployed and reachable (some hardened DedeCMS deployments remove or restrict plus/ endpoints).

Signals are mixed and lean toward moderate rather than critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable, unauthenticated, remote attack with no user interaction - the ideal profile for opportunistic scanning of a PHP CMS endpoint. However, the vendor (VulDB) rated the actual impact as only Low across all three dimensions (VC:L/VI:L/VA:L), which is in direct tension with the 'RCE'/'Code Injection' (CWE-94) framing: genuine arbitrary code execution would normally carry High impacts. This suggests the 'aid' injection in plus/mytag_js.php yields a constrained primitive (e.g., limited include/injection or partial disclosure) rather than full server takeover, OR that VulDB scored conservatively. Exploit maturity is E:P (proof-of-concept) and the description states the exploit 'has been made public,' so publicly available exploit code exists - but this is NOT active exploitation. There is no CISA KEV listing and no EPSS score in the provided data. Net: a real, easy-to-reach issue worth patching promptly given DedeCMS's exposure to mass scanning, but the Low technical-impact rating tempers it below true-critical. The RCE claim versus Low CVSS impact metrics is the key conflict - verify the concrete primitive against the VulDB writeup before treating as remote code execution.

An unauthenticated attacker sends a crafted HTTP request to plus/mytag_js.php manipulating the 'aid' parameter to inject code into the DedeCMS application context. Because the endpoint requires no authentication or user interaction (PR:N/UI:N) and public POC code exists (E:P), the attack is easily automated across internet-exposed DedeCMS installations. The realized impact appears limited (vendor VC/VI/VA:L), so the outcome is more likely constrained injection or partial compromise than full server-level code execution.