Seeddms
by Seeddms
CVEs (33)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-45754 | Med | 0.35 | 5.4 | 0.00 | May 21, 2025 | A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScript payloads by creating a document with an XSS payload as the document name. | ||
| CVE-2025-25461 | Med | 0.35 | 5.4 | 0.01 | Feb 28, 2025 | A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is… | ||
| CVE-2024-46409 | Med | 0.35 | 5.4 | 0.00 | Oct 4, 2024 | A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter in the Calendar page. | ||
| CVE-2022-28051 | Med | 0.35 | 5.4 | 0.01 | Jun 6, 2022 | The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code. | ||
| CVE-2022-28479 | Med | 0.31 | 4.8 | 0.01 | Jun 6, 2022 | SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu | ||
| CVE-2021-36543 | Med | 0.28 | 4.3 | 0.01 | Aug 3, 2021 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. | ||
| CVE-2021-36542 | Med | 0.28 | 4.3 | 0.01 | Aug 3, 2021 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. | ||
| CVE-2021-35343 | Med | 0.28 | 4.3 | 0.01 | Aug 3, 2021 | Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. | ||
| CVE-2021-26216 | Med | 0.28 | 4.3 | 0.00 | Mar 18, 2021 | SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php. | ||
| CVE-2021-26215 | Med | 0.28 | 4.3 | 0.00 | Mar 18, 2021 | SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. | ||
| CVE-2014-2279 | 0.00 | — | 0.05 | Oct 17, 2014 | Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. (dot dot) in the logname parameter to out/out.LogManagement.php… | |||
| CVE-2014-2278 | 0.00 | — | 0.04 | Oct 17, 2014 | Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging… | |||
| CVE-2014-2280 | 0.00 | — | 0.02 | Mar 20, 2014 | Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter. |
- risk 0.35cvss 5.4epss 0.00
A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScript payloads by creating a document with an XSS payload as the document name.
- risk 0.35cvss 5.4epss 0.01
A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is…
- risk 0.35cvss 5.4epss 0.00
A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter in the Calendar page.
- risk 0.35cvss 5.4epss 0.01
The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code.
- risk 0.31cvss 4.8epss 0.01
SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu
- risk 0.28cvss 4.3epss 0.01
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
- risk 0.28cvss 4.3epss 0.01
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
- risk 0.28cvss 4.3epss 0.01
Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page.
- risk 0.28cvss 4.3epss 0.00
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.
- risk 0.28cvss 4.3epss 0.00
SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.
- CVE-2014-2279Oct 17, 2014risk 0.00cvss —epss 0.05
Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. (dot dot) in the logname parameter to out/out.LogManagement.php…
- CVE-2014-2278Oct 17, 2014risk 0.00cvss —epss 0.04
Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging…
- CVE-2014-2280Mar 20, 2014risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the search feature in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Page 2 of 2