CVE-2018-18578

DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter.

• CWE-79

• https://github.com/ky-j/dedecms/files/2500328/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.docxExploit, Third Party Advisory
• https://github.com/ky-j/dedecms/issues/5Exploit, Third Party Advisory
• https://github.com/ky-j/dedecms/files/2500328/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.docxExploit, Third Party Advisory
• https://github.com/ky-j/dedecms/issues/5Exploit, Third Party Advisory

Published

Oct 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1857IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Se…4.8
• CVE-2018-18570Planon before Live Build 41 has XSS.
• CVE-2018-18571An Incorrect Access Control vulnerability has been identifie…9.1
• CVE-2018-18572osCommerce 2.3.4.1 has an incomplete '.htaccess' for blackli…
• CVE-2018-18573osCommerce 2.3.4.1 has an incomplete '.htaccess' for blackli…
• CVE-2018-18576The Hustle (aka wordpress-popup) plugin through 6.0.5 for Wo…5.3
• CVE-2018-18579Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.p…
• CVE-2018-1858IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cro…8.8
• CVE-2018-18581An issue has been found in LuPng through 2017-03-10. It is a…
• CVE-2018-18582An issue has been found in LuPng through 2017-03-10. It is a…
• CVE-2018-18583An issue has been found in LuPng through 2017-03-10. It is a…
• CVE-2018-18584In mspack/cab.h in libmspack before 0.8alpha and cabextract …6.5