CVE-2019-25778

Versions of SeaCMS through 8.7 are vulnerable to an unauthenticated SQL injection vulnerability. The flaw exists in the rlist[] array parameter , which allows remote attackers to manipulate database queries. By sending crafted GET requests to /comment/api/index.php using backtick-quoted variables...

EUVD-2019-20209

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist values using backtick-quoted...