Seacms
by Seacms
CVEs (116)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-42599 | Hig | 0.57 | 8.8 | 0.01 | Aug 22, 2024 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the… | ||
| CVE-2024-40522 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2024 | There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filtering them before writing them into the php file. An authenticated attacker can exploit this vulnerability to execute… | ||
| CVE-2024-40521 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2024 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on the edited file, attackers can still bypass the restrictions and write code in some way, allowing authenticated attackers… | ||
| CVE-2024-40520 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2024 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_config_mark.php directly splicing and writing the user input data into inc_photowatermark_config.php without processing it, which allows authenticated attackers to exploit the… | ||
| CVE-2024-40519 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2024 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_smtp.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary… | ||
| CVE-2024-40518 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2024 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary… | ||
| CVE-2024-30565 | Hig | 0.57 | 8.8 | 0.02 | Apr 4, 2024 | An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php. | ||
| CVE-2023-46987 | Hig | 0.57 | 8.8 | 0.01 | Dec 28, 2023 | SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php. | ||
| CVE-2023-44846 | Hig | 0.57 | 8.8 | 0.01 | Oct 10, 2023 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component. | ||
| CVE-2023-43278 | Hig | 0.57 | 8.8 | 0.00 | Sep 25, 2023 | A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account. | ||
| CVE-2019-8418 | Hig | 0.57 | 8.8 | 0.01 | Feb 17, 2019 | SeaCMS 7.2 mishandles member.php?mod=repsw4 requests. | ||
| CVE-2018-14910 | Hig | 0.57 | 8.8 | 0.01 | Aug 3, 2018 | SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php). The code is executed by visiting adm1n/admin_ip.php or data/admin/ip.php. This can also be exploited through CSRF. | ||
| CVE-2018-14421 | Hig | 0.57 | 8.8 | 0.01 | Jul 20, 2018 | SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.php). The code is executed by visiting /details/index.php. This can also be exploited through CSRF. | ||
| CVE-2018-13445 | Hig | 0.57 | 8.8 | 0.01 | Jul 8, 2018 | An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/admin_manager.php?action=add. | ||
| CVE-2018-13444 | Hig | 0.57 | 8.8 | 0.01 | Jul 8, 2018 | An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/admin_manager.php?action=save&id=2. | ||
| CVE-2023-44848 | Hig | 0.53 | 8.1 | 0.01 | Oct 10, 2023 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component. | ||
| CVE-2024-44720 | Hig | 0.49 | 7.5 | 0.01 | Sep 9, 2024 | SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php. | ||
| CVE-2024-39027 | Hig | 0.49 | 7.5 | 0.00 | Jul 5, 2024 | SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked. | ||
| CVE-2018-17365 | Hig | 0.49 | 7.5 | 0.02 | Sep 26, 2018 | SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter. | ||
| CVE-2018-16446 | Hig | 0.49 | 7.5 | 0.02 | Sep 4, 2018 | An issue was discovered in SeaCMS through 6.61. adm1n/admin_database.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting install_lock.txt. |
- risk 0.57cvss 8.8epss 0.01
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the…
- risk 0.57cvss 8.8epss 0.01
There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filtering them before writing them into the php file. An authenticated attacker can exploit this vulnerability to execute…
- risk 0.57cvss 8.8epss 0.01
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on the edited file, attackers can still bypass the restrictions and write code in some way, allowing authenticated attackers…
- risk 0.57cvss 8.8epss 0.01
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_config_mark.php directly splicing and writing the user input data into inc_photowatermark_config.php without processing it, which allows authenticated attackers to exploit the…
- risk 0.57cvss 8.8epss 0.01
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_smtp.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary…
- risk 0.57cvss 8.8epss 0.01
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary…
- risk 0.57cvss 8.8epss 0.02
An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php.
- risk 0.57cvss 8.8epss 0.01
SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php.
- risk 0.57cvss 8.8epss 0.01
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component.
- risk 0.57cvss 8.8epss 0.00
A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.
- risk 0.57cvss 8.8epss 0.01
SeaCMS 7.2 mishandles member.php?mod=repsw4 requests.
- risk 0.57cvss 8.8epss 0.01
SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php). The code is executed by visiting adm1n/admin_ip.php or data/admin/ip.php. This can also be exploited through CSRF.
- risk 0.57cvss 8.8epss 0.01
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.php). The code is executed by visiting /details/index.php. This can also be exploited through CSRF.
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add a user account via adm1n/admin_manager.php?action=add.
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in SeaCMS 6.61. There is a CSRF vulnerability that can add an admin account via adm1n/admin_manager.php?action=save&id=2.
- risk 0.53cvss 8.1epss 0.01
An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component.
- risk 0.49cvss 7.5epss 0.01
SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.
- risk 0.49cvss 7.5epss 0.00
SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked.
- risk 0.49cvss 7.5epss 0.02
SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter.
- risk 0.49cvss 7.5epss 0.02
An issue was discovered in SeaCMS through 6.61. adm1n/admin_database.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting install_lock.txt.
Page 3 of 6