CVE-2018-19350

SeaCMS v6.6.4 is vulnerable to a stored XSS via the email parameter in member.php?action=chgpwdsubmit during password changes. The issue is demonstrated by a data: URL inside an OBJECT element. Confirmed by multiple sources (NVD entry CVE-2018-19350 and CNVD/CVEs referencing SeaCMS 6.6.4). The vu...

CVE-2018-19349

SeaCMS 6.64 is affected by CVE-2018-19349 via an SQL injection in the admin_makehtml.php topic parameter, caused by mishandling in include/mkhtml.func.php. This vulnerability is corroborated by multiple connected records (CNVD/NVD). The documented impact includes database integrity/ confidentiali...

PT-2018-14935

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.6.4 Description The issue concerns a stored XSS that can be triggered via the member.php?action=chgpwdsubmit endpoint, specifically through the email parameter during a password change process. This can be exploited by using a...

PT-2018-14933

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.64 Description The issue is related to SQL injection due to mishandling in the include/mkhtml.func.php file. This occurs via the topic parameter in the admin makehtml.php file. Recommendations For SeaCMS version 6.64, consider...

CVE-2018-19349: Improper Neutralization of Special Elements used in an SQL Command

In SeaCMS v6.64, there is SQL injection via the adminmakehtml.php topic parameter because of mishandling in include/mkhtml.func.php...

CVE-2018-19350: Improper Neutralization of Input During Web Page Generation

In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element...

SeaCMS Arbitrary File Deletion Vulnerability (CNVD-2018-20079)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 6.64. A remote attacker can exploit the vulnerability to delete arbitrary files with the hel...

CVE-2018-17365

SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter...

CVE-2018-17365

SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter...

Code injection

SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter...

CVE-2018-17365

SeaCMS versions 6.64 and 7.2 expose an ARBITRARY FILE DELETION vulnerability exploitable via the filedir parameter. The root cause is improper handling of the filedir input, allowing remote attackers to delete files on the server. Impact is exposure of file deletion capability (integrity/availabi...

CVE-2018-17365

SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter...

SeaCMS Path Traversal Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A path traversal vulnerability exists in SeaCMS version 6.64, which can be exploited by an attacker by sending...

CVE-2018-17365: Improper Limitation of a Pathname to a Restricted Directory

SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter...

PT-2018-13994

Name of the Vulnerable Software and Affected Versions SeaCMS versions 6.64 through 7.2 Description The issue allows remote attackers to delete arbitrary files. This is achieved via the filedir parameter. Recommendations For SeaCMS versions 6.64 through 7.2, avoid using the filedir parameter in...

SeaCMS cross-site scripting vulnerability (CNVD-2018-20093)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the admindatarelate.php file in SeaCMS version 6.64. A remote attacker can exploit this...

Design/Logic Flaw

An issue was discovered in SeaCMS 6.64. XSS exists in admindatarelate.php via the time or maxHit parameter in a dorandomset action...

CVE-2018-17321

An issue was discovered in SeaCMS 6.64. XSS exists in admindatarelate.php via the time or maxHit parameter in a dorandomset action...

CVE-2018-17321

An issue was discovered in SeaCMS 6.64. XSS exists in admindatarelate.php via the time or maxHit parameter in a dorandomset action...

CVE-2018-17321

SeaCMS 6.64 is affected by a cross-site scripting (XSS) vulnerability in admin_datarelate.php, exploitable via the time or maxHit parameter in a dorandomset action. The issue stems from input handling in that action, enabling an attacker to inject arbitrary web script or HTML. Affected component:...