DedeCMS, FineReport, YiShaAdmin, Bytebase: Four Old Flaws Finally Get CVE IDs (CVE-2021-48016, 48014, CVE-2022-51022, 51026)

On October 22, 2026, NVD published four CVEs carrying 2021 and 2022 IDs: DedeCMS, FineReport (FanRuan), YiShaAdmin and Bytebase. VulnCheck assigned all of them, filling a gap: these flaws had been publicly documented for years, sometimes with a ready-made Nuclei template, but never had a CVE ID.

For three of them, the NVD description notes that the Shadowserver Foundation observed exploitation attempts as early as October 2023. So they're nothing new to attackers. What made them invisible was the missing CVE, which kept them out of every scanner and monitoring tool that keys on that identifier.

The CVSS 3.1 scores come from VulnCheck (CNA). Three share the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; YiShaAdmin is C:H/I:N/A:H (file read and delete, no write). Under CVSS 4.0, VulnCheck gives 9.3, except YiShaAdmin at 8.8. NVD hasn't analyzed these entries: Deferred for DedeCMS, FineReport and YiShaAdmin, Received for Bytebase. The exploitation dates come from the NVD descriptions (Shadowserver observations); none of these CVEs is in CISA KEV at the time of writing.

DedeCMS — CVE-2021-48016: The Referer Gets Executed

DedeCMS, a PHP CMS widely deployed in China, writes the HTTP Referer header into a DedeTemplate string inside ShowMsg(), then includes it. An unauthenticated attacker sends a Referer carrying PHP to /plus/flink.php?dopost=save with an empty validation code, and gets arbitrary PHP and system command execution.

NVD lists no fixed version: the range runs "through 5.8.1-beta".

FineReport — CVE-2021-48014: Dropping a Webshell

In FineReport 9.0, the design_save_svg operation of /WebReport/ReportServer takes a filePath parameter without any checks. An unauthenticated POST with traversal sequences in filePath and a payload in __CONTENT__ writes a JSP webshell, and with it remote code execution.

NVD gives no fixed version: check with the vendor, FanRuan.

YiShaAdmin — CVE-2022-51022: Read or Delete Any File

YiShaAdmin's /admin/File/DownloadFile endpoint (a .NET admin panel) accepts a filePath parameter with no authentication and no validation. With traversal sequences, an attacker reads system files; add the delete parameter and they're gone. That's where the availability impact in the vector comes from.

NVD says the fix landed in commit 025b062 of the repository.

Bytebase — CVE-2022-51026: Log In with Your Own GitLab

Bytebase, a database schema change management tool, trusted the GitLab provider configuration sent by the client on POST /api/auth/login/GITLAB_SELF_HOST. The attacker sets instanceUrl to a server they control, which answers with an active user and any email address they like. Bytebase then issues a session for that principal: impersonation of any user, Owner included, or creation of new members.

NVD references 1.0.1 as the first release outside the range. For a tool holding write access to production databases, any instance still on an earlier version is worth tracking down.

Why These Old IDs Matter

1. Scanners think in CVEs. A flaw with no ID shows up neither in vulnerability reports nor in NVD-driven alerts. These four only become visible now.
2. Exploitation in 2023 isn't ancient history. Unpatched DedeCMS, FineReport or YiShaAdmin instances stay online for years, and the Nuclei templates in the references make finding them trivial.
3. No fixed version doesn't mean no risk. For DedeCMS and FineReport, NVD gives no exit version, so internet exposure is the variable that actually matters.

These are inferences: NVD doesn't describe any recent campaign targeting these CVEs.

Detection

• Inventory: these products are often deployed by integrators or in subsidiaries. Look for the paths /plus/flink.php (DedeCMS), /WebReport/ReportServer (FineReport), /admin/File/DownloadFile (YiShaAdmin) and the Bytebase UI.
• Web logs:
  • DedeCMS: requests to /plus/flink.php?dopost=save with a Referer containing PHP code;
  • FineReport: design_save_svg POSTs with ../ in filePath, new .jsp files in the web root;
  • YiShaAdmin: filePath containing ../, or the delete parameter;
  • Bytebase: logins through GITLAB_SELF_HOST with an instanceUrl that isn't your GitLab.
• Nuclei templates: the ones NVD references for DedeCMS, FineReport and YiShaAdmin let you check your own perimeter.

Mitigation

1. Bytebase: move to 1.0.1 or later (in practice, a maintained release) and review the member list and the Owner.
2. YiShaAdmin: pull in the fix from commit 025b062 or a release that includes it.
3. DedeCMS and FineReport: with no fixed version cited by NVD, take these apps off the internet (VPN, IP filtering) and contact the vendor. At a minimum, block /plus/flink.php and the design_save_svg operation at the reverse proxy.
4. If an instance was exposed: given exploitation observed since 2023, hunt for webshells and unknown accounts before calling the server clean.

Why Continuous Monitoring of Your Application Inventory Matters

An app installed four years ago can get a critical CVE today, for a flaw that has been exploited for three. Only an up-to-date inventory lets you connect the dots.

With cveo.tech, add your web applications to your inventory and get an alert as soon as a critical CVE hits them, even when it carries an old ID.