CVE-2021-48016 — DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthentic…
Published: 2026-10-22 · CVSS: 9.3 · CVSS 4.0
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7