CVE-2026-19353

mediumpriority · track · 0EPSS 0.004 · 32 %ileEURU

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (32nd) EPSS

CVSS 4.6 · medium

Is it mine?

2 products

Check your exposure

Who says so?

2 sources

enisa_euvd · fstec_bdu

EPSS · scored 2026-10-27

A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.

cvss

Technical severity, 0–10. One row per scoring source.

5.0

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 0.6–5

v2.04.6mediumAV:N/AC:H/Au:S/C:P/I:P/A:Psecondary · cna@vuldb.comexploitability 3.9 · impact 6.4

v3.15mediumAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.15mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · cna@vuldb.comexploitability 1.6 · impact 3.4

v4.02.3lowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:Psecondary · ENISA EU

v4.01.3lowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cna@vuldb.com

v4.00.6lowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)