CVE-2021-48016 (CVSS 9.8): DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is wri

VulnCheck's advisory says that DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included.[2]The same advisory states that unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands.[2]A GitHub vulnerability-alert entry citing NVD data lists the flaw as published: 2026-10-22[3], with a CVSS v3.1 score of 9.8. VulnCheck's own advisory gives a CVSS v4 score of 9.3 and credit: The Shadowserver Foundation[2].VulnDB says the bug only affects products that are no longer supported by the maintainer[4], and that no form of authentication is needed for exploitation.[4] VulDB states technical details of the vulnerability are known, but there is no available exploit.[4] TheHackerWire, however, reports that public proof-of-concept (PoC) exploit references and code are available for CVE-2021-48016.[5]TheHackerWire also reports that the flaw is not recorded in the CISA Known Exploited Vulnerabilities (KEV) catalog[5]. VulnCheck states that this advisory is in the VulnCheck KEV database[2].For defenders, Hol advises users to monitor this advisory for an available fix and review any installs of the affected package.[6]