CVE-2018-18579

Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter.

• CWE-79

• https://github.com/ky-j/dedecms/files/2501671/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7sp2.docxExploit, Third Party Advisory
• https://github.com/ky-j/dedecms/issues/6Exploit, Third Party Advisory
• https://github.com/ky-j/dedecms/files/2501671/Reflected.XSS.Vulnerability.exists.in.the.file.of.DedeCMS.V5.7sp2.docxExploit, Third Party Advisory
• https://github.com/ky-j/dedecms/issues/6Exploit, Third Party Advisory

Published

Oct 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18570Planon before Live Build 41 has XSS.
• CVE-2018-18571An Incorrect Access Control vulnerability has been identifie…9.1
• CVE-2018-18572osCommerce 2.3.4.1 has an incomplete '.htaccess' for blackli…
• CVE-2018-18573osCommerce 2.3.4.1 has an incomplete '.htaccess' for blackli…
• CVE-2018-18576The Hustle (aka wordpress-popup) plugin through 6.0.5 for Wo…5.3
• CVE-2018-18578DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type para…
• CVE-2018-1858IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cro…8.8
• CVE-2018-18581An issue has been found in LuPng through 2017-03-10. It is a…
• CVE-2018-18582An issue has been found in LuPng through 2017-03-10. It is a…
• CVE-2018-18583An issue has been found in LuPng through 2017-03-10. It is a…
• CVE-2018-18584In mspack/cab.h in libmspack before 0.8alpha and cabextract …6.5
• CVE-2018-18585chmd_read_headers in mspack/chmd.c in libmspack before 0.8al…4.3