CVE-2026-10608: DedeCMS carbuyaction.php RemoveXSS sql injection
A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulation of the argument postname/des results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply a compensating control by blocking or restricting remote access to DedeCMS /plus/carbuyaction.php (e.g., via web server/WAF rules) to reduce exposure to the publicly released SQL injection exploit that targets the postname/des argument used by RemoveXSS.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10608?
The severity of CVE-2026-10608 is rated as medium with a score of 5.5.
What type of vulnerability is associated with CVE-2026-10608?
CVE-2026-10608 is associated with SQL Injection and XSS vulnerabilities.
How do I fix CVE-2026-10608?
To fix CVE-2026-10608, you should update DedeCMS to the latest version that addresses this issue.
Can CVE-2026-10608 be exploited remotely?
Yes, CVE-2026-10608 can be exploited remotely through specific manipulations of the argument postname/des.
Which file is affected by CVE-2026-10608?
The file affected by CVE-2026-10608 is /plus/carbuyaction.php in DedeCMS version 5.7.88.