CVE-2023-40874

Name of the Vulnerable Software and Affected Versions DedeCMS versions up to and including 5.7.110

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities are located at the "/dede/vote add.php" API endpoint via the votename and voteitem1 parameters.

Recommendations For DedeCMS versions up to and including 5.7.110, as a temporary workaround, consider restricting access to the "/dede/vote add.php" endpoint or avoiding the use of the votename and voteitem1 parameters until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.