Seacms
by Seacms
CVEs (116)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-55461 | 0.00 | — | 0.01 | Dec 18, 2024 | SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext(). | |||
| CVE-2024-50808 | 0.00 | — | 0.01 | Nov 8, 2024 | SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in admin_notify.php. | |||
| CVE-2024-46640 | 0.00 | — | 0.01 | Sep 20, 2024 | SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not executed during execution, allowing remote code execution by writing to the file through the MySQL slow query method. | |||
| CVE-2024-44720 | 0.00 | — | 0.01 | Sep 9, 2024 | SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php. | |||
| CVE-2024-44721 | 0.00 | — | 0.01 | Sep 9, 2024 | SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php. | |||
| CVE-2024-44921 | 0.00 | — | 0.01 | Sep 3, 2024 | SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del. | |||
| CVE-2024-44920 | 0.00 | — | 0.00 | Sep 3, 2024 | A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the siteurl parameter. | |||
| CVE-2024-44683 | 0.00 | — | 0.00 | Aug 30, 2024 | Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php. | |||
| CVE-2024-44918 | 0.00 | — | 0.00 | Aug 30, 2024 | A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |||
| CVE-2024-44916 | 0.00 | — | 0.01 | Aug 30, 2024 | Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and could result in arbitrary command execution. | |||
| CVE-2024-44919 | 0.00 | — | 0.00 | Aug 29, 2024 | A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ad description parameter. | |||
| CVE-2024-41444 | 0.00 | — | 0.00 | Aug 26, 2024 | SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so. | |||
| CVE-2024-42599 | 0.00 | — | 0.01 | Aug 22, 2024 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the… | |||
| CVE-2024-42598 | 0.00 | — | 0.01 | Aug 20, 2024 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the… | |||
| CVE-2024-7163 | 0.00 | — | 0.00 | Jul 28, 2024 | A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross site scripting. It is possible to initiate the attack… | |||
| CVE-2024-7162 | 0.00 | — | 0.00 | Jul 28, 2024 | A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionality of the file js/player/dmplayer/admin/post.php?act=setting. The manipulation of the argument yzm leads to cross site scripting. The… | |||
| CVE-2024-7161 | 0.00 | — | 0.00 | Jul 28, 2024 | A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=chgpwdsubmit of the component Password Change Handler. The manipulation of the argument newpwd/newpwd2 leads to… | |||
| CVE-2024-39036 | 0.00 | — | 0.01 | Jul 16, 2024 | SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php. | |||
| CVE-2024-40521 | 0.00 | — | 0.01 | Jul 12, 2024 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on the edited file, attackers can still bypass the restrictions and write code in some way, allowing authenticated attackers… | |||
| CVE-2024-40518 | 0.00 | — | 0.01 | Jul 12, 2024 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary… |
- CVE-2024-55461Dec 18, 2024risk 0.00cvss —epss 0.01
SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().
- CVE-2024-50808Nov 8, 2024risk 0.00cvss —epss 0.01
SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in admin_notify.php.
- CVE-2024-46640Sep 20, 2024risk 0.00cvss —epss 0.01
SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not executed during execution, allowing remote code execution by writing to the file through the MySQL slow query method.
- CVE-2024-44720Sep 9, 2024risk 0.00cvss —epss 0.01
SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.
- CVE-2024-44721Sep 9, 2024risk 0.00cvss —epss 0.01
SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.
- CVE-2024-44921Sep 3, 2024risk 0.00cvss —epss 0.01
SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del.
- CVE-2024-44920Sep 3, 2024risk 0.00cvss —epss 0.00
A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the siteurl parameter.
- CVE-2024-44683Aug 30, 2024risk 0.00cvss —epss 0.00
Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php.
- CVE-2024-44918Aug 30, 2024risk 0.00cvss —epss 0.00
A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- CVE-2024-44916Aug 30, 2024risk 0.00cvss —epss 0.01
Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and could result in arbitrary command execution.
- CVE-2024-44919Aug 29, 2024risk 0.00cvss —epss 0.00
A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ad description parameter.
- CVE-2024-41444Aug 26, 2024risk 0.00cvss —epss 0.00
SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so.
- CVE-2024-42599Aug 22, 2024risk 0.00cvss —epss 0.01
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the…
- CVE-2024-42598Aug 20, 2024risk 0.00cvss —epss 0.01
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the…
- CVE-2024-7163Jul 28, 2024risk 0.00cvss —epss 0.00
A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross site scripting. It is possible to initiate the attack…
- CVE-2024-7162Jul 28, 2024risk 0.00cvss —epss 0.00
A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionality of the file js/player/dmplayer/admin/post.php?act=setting. The manipulation of the argument yzm leads to cross site scripting. The…
- CVE-2024-7161Jul 28, 2024risk 0.00cvss —epss 0.00
A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=chgpwdsubmit of the component Password Change Handler. The manipulation of the argument newpwd/newpwd2 leads to…
- CVE-2024-39036Jul 16, 2024risk 0.00cvss —epss 0.01
SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php.
- CVE-2024-40521Jul 12, 2024risk 0.00cvss —epss 0.01
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on the edited file, attackers can still bypass the restrictions and write code in some way, allowing authenticated attackers…
- CVE-2024-40518Jul 12, 2024risk 0.00cvss —epss 0.01
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary…
Page 4 of 6