Vulnerability · Published Sep 20, 2026 · Assigned by VulDB
CVE-2026-94004DedeCMS mytag_js.php code injection
High 7.3
In plain English
A high-severity code injection in DedeCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 55.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytag_js.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used.
Affected products (as reported)
Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-407953 | DedeCMS mytag_js.php code injection vdb-entry, technical-description
- VDB-407953 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-94004 | CVE Analysis and Report third-party-advisory
- Submit #944743 | Shanghai Zhuozhuo Network Technology Co.,Ltd. DedeCMS 5.7.118 CWE-94 third-party-advisory