Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Seacms
(Seacms)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 75 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2022-11-16 | CVE-2022-43256 | SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php. | Seacms | 9.8 | ||
| 2024-07-05 | CVE-2024-39027 | SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked. | Seacms | 7.5 | ||
| 2024-08-30 | CVE-2024-44683 | Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php. | Seacms | 6.1 | ||
| 2024-07-12 | CVE-2024-40522 | There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filtering them before writing them into the php file. An authenticated attacker can exploit this vulnerability to execute arbitrary commands and obtain system permissions. | Seacms | 8.8 | ||
| 2025-02-24 | CVE-2025-25513 | Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php. | Seacms | 9.8 | ||
| 2024-06-10 | CVE-2024-31611 | SeaCMS 12.9 has a file deletion vulnerability via admin_template.php. | Seacms | 9.1 | ||
| 2024-07-12 | CVE-2024-40521 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on the edited file, attackers can still bypass the restrictions and write code in some way, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges. | Seacms | 8.8 | ||
| 2020-12-21 | CVE-2020-21378 | SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.php. | Seacms | 9.8 | ||
| 2021-05-28 | CVE-2020-26642 | A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an attacker to inject arbitrary web script or HTML. | Seacms | 6.1 | ||
| 2021-08-17 | CVE-2020-28846 | Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin account. | Seacms | 6.5 |