CVE-2019-10014: Dedecms

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated.

Affected products

• Dedecms Dedecms: version 5.7 only

Published 2019-03-24. Last modified 2026-06-17.