CVE-2023-49494

MediumCVSS 6.1

Published: 11/12/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.16%

63th percentile - higher than 63% of all known CVEs

Summary

DedeCMS v5.7.111 was found to have a reflective cross-site scripting (XSS) vulnerability in the select_media_post_wangEditor.php component. An attacker can inject malicious JavaScript code into a request, which will be executed in the victim's browser.

Risk Assessment

The risk includes session hijacking, redirection to malicious sites, or unauthorized actions performed in the context of an authenticated administrator.

Recommendation

Immediately update DedeCMS to the latest available version and apply input filtering in the select_media_post_wangEditor.php component.

Original NVD description (English source)

DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEditor.php.