CVE-2026-15533

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7.118

Description A remote code injection flaw exists within the Column Management component in the /plus/search.php endpoint. The issue occurs when the Column Name argument is manipulated, allowing an attacker to execute arbitrary code remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the /plus/search.php endpoint to minimize the risk of exploitation.