Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N H N L N L L L 1.3 .0024 15.5 —
AFFECTED Product Versions Fixed DedeCMS 5.7.118 UTF8SP2 – —
TIMELINE Aug 8 Reserved by VulDB Aug 9 Published (CNA: VulDB) Aug 10 EXPLOIT PUBLISHED — CVE-2026-19353 (DedeCMS). Public exploit reference added.
A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.
| Date | Event | Detail |
|---|---|---|
| August 8, 2026 | Reserved | Reserved by VulDB |
| August 9, 2026 | Published | Published (CNA: VulDB) |
| August 10, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-19353 (DedeCMS). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | DedeCMS | — | 5.7.118 UTF8SP2 | — |
Authoritative record: CVE-2026-19353 at cve.org
Weaknesses: CWE-73
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19353 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.