CVE-2026-10606— DedeCMS Feedback feedback.php TrimMsg sql injection
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-10606
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DedeCMS Feedback feedback.php TrimMsg sql injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | DedeCMS | 5.7.88 | cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-10606
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
default-local-qwen3.6 · 4711 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-10606
请登录查看更多情报信息。
Same Patch Batch · n/a · 2026-06-02 · 16 CVEs total
| CVE-2026-10608 | 7.3 HIGH | DedeCMS carbuyaction.php RemoveXSS sql injection |
| CVE-2026-10607 | 7.3 HIGH | DedeCMS flink.php dede_htmlspecialchars sql injection |
| CVE-2026-10581 | 6.3 MEDIUM | DedeCMS download.php base64_decode server-side request forgery |
| CVE-2026-10565 | 3.1 LOW | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition |
| CVE-2026-35717 | VIVOTEK FD8136栈溢出漏洞 | |
| CVE-2026-35716 | VIVOTEK FD8136栈缓冲区溢出漏洞 | |
| CVE-2026-35718 | VIVOTEK FD8136-VVTK 0300a路径遍历漏洞 | |
| CVE-2026-38978 | Transmission 4.1.1 WebUI/RPC 点击劫持漏洞 | |
| CVE-2026-30652 | Vivotek FD8136固件远程缓冲区溢出漏洞 | |
| CVE-2026-30649 | VIVOTEK FD8136-VVTK-0300a CGI缓冲区溢出导致任意代码执行 | |
| CVE-2026-30650 | Vivotek FD8136 VVTK-0300a远程代码执行漏洞 | |
| CVE-2026-48682 | FastNetMon 1.2.9 IPv4解析越界读取漏洞 | |
| CVE-2026-38967 | Crow HTTP响应头注入漏洞（v1.3.1及以下） | |
| CVE-2026-30586 | Memos v0.26.0 存储型跨站脚本漏洞 | |
| CVE-2026-33553 | CFEngine Enterprise 3.24.x/3.27.x跨站脚本漏洞 |
IV. Related Vulnerabilities
Same product: DedeCMS
- CVE-2026-10608
DedeCMS carbuyaction.php RemoveXSS sql injection - CVE-2026-10607
DedeCMS flink.php dede_htmlspecialchars sql injection - CVE-2026-10581
DedeCMS download.php base64_decode server-side request forge - CVE-2025-15004
DedeCMS freelist_main.php sql injection - CVE-2025-6335
DedeCMS Template dedetag.class.php command injection
Same vendor: n/a
- CVE-2026-10608
DedeCMS carbuyaction.php RemoveXSS sql injection - CVE-2026-10607
DedeCMS flink.php dede_htmlspecialchars sql injection - CVE-2026-10581
DedeCMS download.php base64_decode server-side request forge - CVE-2026-10565
Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race - CVE-2026-35717
VIVOTEK FD8136栈溢出漏洞
Same weakness: CWE-89
- CVE-2026-10620
code-projects Student Admission System index.php sql injecti - CVE-2026-5073
ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection vi - CVE-2026-5074
ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL - CVE-2026-10608
DedeCMS carbuyaction.php RemoveXSS sql injection - CVE-2026-10607
DedeCMS flink.php dede_htmlspecialchars sql injection
V. Comments for CVE-2026-10606
No comments yet