CVE-2018-17321

SeaCMS 6.64 is affected by a cross-site scripting (XSS) vulnerability in admin_datarelate.php, exploitable via the time or maxHit parameter in a dorandomset action. The issue stems from input handling in that action, enabling an attacker to inject arbitrary web script or HTML. Affected component:...

CVE-2018-16822

SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...

CVE-2018-16822

SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...

CVE-2018-16821

SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...

CVE-2018-16821

SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...

Sql injection

SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...

Design/Logic Flaw

SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...

CVE-2018-16822

SeaCMS 6.64 contains a SQL Injection in the upload/admin/admin_video.php order parameter. The underlying issue is improper handling/validation of the order parameter, enabling remote attackers to craft SQL commands. Severity is high (CVSS v3.0: CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The ...

CVE-2018-16821

SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...

CVE-2018-16821

SeaCMS 6.64 contains a path traversal flaw that allows arbitrary directory listing through upload/admin/admin_template.php?path=../templets/../../, enabling access to unintended directories. The vulnerability is a directory traversal issue in the PHP-based SeaCMS CMS; the exports/documented expos...

CVE-2018-16822

SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...

SeaCMS cross-site scripting vulnerability (CNVD-2018-19743)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the adminvideo.php file in SeaCMS version 6.64. A remote attacker can exploit this vulnerabilit...

CVE-2018-17062

An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...

Design/Logic Flaw

An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...

CVE-2018-17062

An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...

CVE-2018-17062

SeaCMS 6.64 contains a cross-site scripting (XSS) vulnerability in admin_video.php exploitable via the action, area, type, yuyan, jqtype, v_isunion, v_recycled, v_ismoney, or v_ispsd parameters. The issue is documented across multiple sources (NVD CVE-2018-17062, CNVD-2018-19743, CVELIST, PRION) ...

CVE-2018-17062

An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...

Sql injection

An issue was discovered in SeaCMS through 6.61. SQL injection exists via the tid parameter in an adm1n/admintopicvod.php request...

CVE-2018-16444

An issue was discovered in SeaCMS 6.61. adm1n/adminreslib.php has SSRF via the url parameter...

CVE-2018-16446

An issue was discovered in SeaCMS through 6.61. adm1n/admindatabase.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting installlock.txt...