CVE-2017-17731

DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.

• CWE-89

• http://0day5.com/archives/1346/Exploit, Issue Tracking, Third Party Advisory
• http://0day5.com/archives/1346/Exploit, Issue Tracking, Third Party Advisory

Published

Dec 18, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17723In Exiv2 0.26, there is a heap-based buffer over-read in the…
• CVE-2017-17724In Exiv2 0.26, there is a heap-based buffer over-read in the…
• CVE-2017-17725In Exiv2 0.26, there is an integer overflow leading to a hea…
• CVE-2017-17727DedeCMS through 5.6 allows arbitrary file upload and PHP cod…
• CVE-2017-1773IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an…
• CVE-2017-17730DedeCMS through 5.7 has SQL Injection via the logo parameter…
• CVE-2017-17733Maccms 8.x allows remote command execution via the wd parame…
• CVE-2017-17734CMS Made Simple (CMSMS) before 2.2.5 does not properly cache…
• CVE-2017-17735CMS Made Simple (CMSMS) before 2.2.5 does not properly cache…
• CVE-2017-17736Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows rem…
• CVE-2017-17737The BrightSign Digital Signage (4k242) device (Firmware 6.2.…
• CVE-2017-17738The BrightSign Digital Signage (4k242) device (Firmware 6.2.…