DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component select_media.php via the `activepath` `keyword` `tag` `fmdo=x&filename` `CKEditor` and `CKEditorFuncNum` parameters.