1344 matches found
CVE-2018-17321
SeaCMS 6.64 is affected by a cross-site scripting (XSS) vulnerability in admin_datarelate.php, exploitable via the time or maxHit parameter in a dorandomset action. The issue stems from input handling in that action, enabling an attacker to inject arbitrary web script or HTML. Affected component:...
CVE-2018-17321: Improper Neutralization of Input During Web Page Generation
An issue was discovered in SeaCMS 6.64. XSS exists in admindatarelate.php via the time or maxHit parameter in a dorandomset action...
CVE-2018-16822
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16822
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16821
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
CVE-2018-16821
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
Sql injection
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
Design/Logic Flaw
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
CVE-2018-16822
SeaCMS 6.64 contains a SQL Injection in the upload/admin/admin_video.php order parameter. The underlying issue is improper handling/validation of the order parameter, enabling remote attackers to craft SQL commands. Severity is high (CVSS v3.0: CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The ...
CVE-2018-16821
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
CVE-2018-16821
SeaCMS 6.64 contains a path traversal flaw that allows arbitrary directory listing through upload/admin/admin_template.php?path=../templets/../../, enabling access to unintended directories. The vulnerability is a directory traversal issue in the PHP-based SeaCMS CMS; the exports/documented expos...
CVE-2018-16822
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16822: Improper Neutralization of Special Elements used in an SQL Command
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16821: Unrestricted Upload of File with Dangerous Type
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
SeaCMS cross-site scripting vulnerability (CNVD-2018-19743)
SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the adminvideo.php file in SeaCMS version 6.64. A remote attacker can exploit this vulnerabilit...
CVE-2018-17062
An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...
Design/Logic Flaw
An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...
CVE-2018-17062
An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...
CVE-2018-17062
SeaCMS 6.64 contains a cross-site scripting (XSS) vulnerability in admin_video.php exploitable via the action, area, type, yuyan, jqtype, v_isunion, v_recycled, v_ismoney, or v_ispsd parameters. The issue is documented across multiple sources (NVD CVE-2018-17062, CNVD-2018-19743, CVELIST, PRION) ...