1338 matches found
Sql injection
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
Design/Logic Flaw
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
CVE-2018-16822
SeaCMS 6.64 contains a SQL Injection in the upload/admin/admin_video.php order parameter. The underlying issue is improper handling/validation of the order parameter, enabling remote attackers to craft SQL commands. Severity is high (CVSS v3.0: CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The ...
CVE-2018-16821
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
CVE-2018-16821
SeaCMS 6.64 contains a path traversal flaw that allows arbitrary directory listing through upload/admin/admin_template.php?path=../templets/../../, enabling access to unintended directories. The vulnerability is a directory traversal issue in the PHP-based SeaCMS CMS; the exports/documented expos...
CVE-2018-16822
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16822: Improper Neutralization of Special Elements used in an SQL Command
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16821: Unrestricted Upload of File with Dangerous Type
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
SeaCMS cross-site scripting vulnerability (CNVD-2018-19743)
SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the adminvideo.php file in SeaCMS version 6.64. A remote attacker can exploit this vulnerabilit...
Design/Logic Flaw
An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...
CVE-2018-17062
An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...
CVE-2018-17062
An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...
CVE-2018-17062
SeaCMS 6.64 contains a cross-site scripting (XSS) vulnerability in admin_video.php exploitable via the action, area, type, yuyan, jqtype, v_isunion, v_recycled, v_ismoney, or v_ispsd parameters. The issue is documented across multiple sources (NVD CVE-2018-17062, CNVD-2018-19743, CVELIST, PRION) ...
CVE-2018-17062
An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...
CVE-2018-17062: Improper Neutralization of Input During Web Page Generation
An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...
Sql injection
An issue was discovered in SeaCMS through 6.61. SQL injection exists via the tid parameter in an adm1n/admintopicvod.php request...
CVE-2018-16444
An issue was discovered in SeaCMS 6.61. adm1n/adminreslib.php has SSRF via the url parameter...
CVE-2018-16445
An issue was discovered in SeaCMS through 6.61. SQL injection exists via the tid parameter in an adm1n/admintopicvod.php request...
CVE-2018-16446
An issue was discovered in SeaCMS through 6.61. adm1n/admindatabase.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting installlock.txt...
CVE-2018-16446
An issue was discovered in SeaCMS through 6.61. adm1n/admindatabase.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting installlock.txt...