CVE-2018-6910

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php.

• CWE-668

• https://github.com/kongxin520/DedeCMS/blob/master/DedeCMS_5.7_Bug.mdBroken Link, Third Party Advisory
• https://kongxin.gitbook.io/dedecms-5-7-bug/Exploit, Third Party Advisory
• https://github.com/kongxin520/DedeCMS/blob/master/DedeCMS_5.7_Bug.mdBroken Link, Third Party Advisory
• https://kongxin.gitbook.io/dedecms-5-7-bug/Exploit, Third Party Advisory

Published

Feb 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6904PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the Use…
• CVE-2018-6905The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS v…
• CVE-2018-6906A persistent Cross Site Scripting (XSS) vulnerability in the…
• CVE-2018-6907A Cross Site Request Forgery (CSRF) vulnerability in the Gre…
• CVE-2018-6908An authentication bypass vulnerability exists in the Green E…
• CVE-2018-6909A missing X-Frame-Options header in the Green Electronics Ra…
• CVE-2018-6911The VBWinExec function in Node\AspVBObj.dll in Advantech Web…
• CVE-2018-6912The decode_plane function in libavcodec/utvideodec.c in FFmp…
• CVE-2018-6913Heap-based buffer overflow in the pack function in Perl befo…
• CVE-2018-6914Directory traversal vulnerability in the Dir.mktmpdir method…
• CVE-2018-6916In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p7, 10.4-STABLE,…
• CVE-2018-6917In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE,…