1441 matches found
CVE-2018-17321
An issue was discovered in SeaCMS 6.64. XSS exists in admindatarelate.php via the time or maxHit parameter in a dorandomset action...
PT-2018-13982
Name of the Vulnerable Software and Affected Versions SeaCMS version 6.64 Description A security issue was found in the software. Cross-site scripting XSS exists in the admin datarelate.php file via the time or maxHit parameter in a dorandomset action. Recommendations For SeaCMS version 6.64,...
CVE-2018-17321: Improper Neutralization of Input During Web Page Generation
An issue was discovered in SeaCMS 6.64. XSS exists in admindatarelate.php via the time or maxHit parameter in a dorandomset action...
CVE-2018-16822
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16822
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16821
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
CVE-2018-16821
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
Design/Logic Flaw
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
Sql injection
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16821
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
CVE-2018-16822
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16821
SeaCMS 6.64 contains a path traversal flaw that allows arbitrary directory listing through upload/admin/admin_template.php?path=../templets/../../, enabling access to unintended directories. The vulnerability is a directory traversal issue in the PHP-based SeaCMS CMS; the exports/documented expos...
CVE-2018-16822
SeaCMS 6.64 contains a SQL Injection in the upload/admin/admin_video.php order parameter. The underlying issue is improper handling/validation of the order parameter, enabling remote attackers to craft SQL commands. Severity is high (CVSS v3.0: CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The ...
CVE-2018-16822: Improper Neutralization of Special Elements used in an SQL Command
SeaCMS 6.64 allows SQL Injection via the upload/admin/adminvideo.php order parameter...
CVE-2018-16821: Unrestricted Upload of File with Dangerous Type
SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admintemplate.php?path=../templets/../../ requests...
PT-2018-13763
Name of the Vulnerable Software and Affected Versions SeaCMS version 6.64 Description The issue allows SQL Injection via the order parameter in the upload/admin/admin video.php endpoint. Recommendations For SeaCMS version 6.64, consider restricting access to the upload/admin/admin video.php...
PT-2018-13762
Name of the Vulnerable Software and Affected Versions SeaCMS version 6.64 Description The issue allows for arbitrary directory listing. This can be achieved through specific requests to the upload/admin/admin template.php endpoint, where the path parameter is manipulated to access directories...
SeaCMS cross-site scripting vulnerability (CNVD-2018-19743)
SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the adminvideo.php file in SeaCMS version 6.64. A remote attacker can exploit this vulnerabilit...