SeaCMS SQL Injection Vulnerability (CNVD-2019-08332)

SeaCMS Ocean CMS is a professional open source free PHP film and television system. 6.61 and earlier versions of SeaCMS SQL injection vulnerability, attackers can through the adm1n/admintopicvod.php request in the tid parameter to take advantage of the vulnerability for SQL injection attacks...

SeaCMS Server-Side Request Forgery Vulnerability

SeaCMS Ocean CMS is a professional open source free PHP film and television system. There is a server-side request forgery vulnerability in adm1n/adminreslib.php in 6.61 and earlier versions of SeaCMS, which can be exploited by an attacker through the url parameter to conduct a server-side reques...

SeaCMS Code Execution Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A code execution vulnerability exists in SeaCMS version 6.61, which originates from the 'parseIf' function in the include/main.class.php file...

SeaCMS cross-site scripting vulnerability (CNVD-2018-19071)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in the adminvideo.php file in SeaCMS version 6.61, which can be exploited by remote attackers to...

PT-2018-13572

Name of the Vulnerable Software and Affected Versions SeaCMS versions prior to 6.62 Description An issue exists in the software, allowing SQL injection via the tid parameter in an "adm1n/admin topic vod.php" request. Recommendations For versions prior to 6.62, update to version 6.62 or later to...

SeaCMS Arbitrary File Deletion Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A security vulnerability exists in the file adm1n/admindatabase.php in SeaCMS 6.61 and earlier versions. The vulnerability can be exploited to...

PT-2018-13573

Name of the Vulnerable Software and Affected Versions SeaCMS versions through 6.61 Description An issue in SeaCMS allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter in the 'adm1n/admin database.php' endpoint. This can lead to the product...

PT-2018-13571

Name of the Vulnerable Software and Affected Versions SeaCMS version 6.61 Description An issue was discovered in SeaCMS, where the adm1n/admin reslib.php file has a Server-Side Request Forgery SSRF vulnerability via the url parameter. Recommendations For SeaCMS version 6.61, consider restricting...

CVE-2018-16444: Server-Side Request Forgery (SSRF)

An issue was discovered in SeaCMS 6.61. adm1n/adminreslib.php has SSRF via the url parameter...

CVE-2018-16446: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in SeaCMS through 6.61. adm1n/admindatabase.php allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter. This can allow the product to be reinstalled by deleting installlock.txt...

CVE-2018-16445: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in SeaCMS through 6.61. SQL injection exists via the tid parameter in an adm1n/admintopicvod.php request...

CVE-2018-16348

SeaCMS V6.61 has XSS via the adminvideo.php vcontent parameter, related to the site name...

CVE-2018-16343

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

Cross site scripting

SeaCMS V6.61 has XSS via the adminvideo.php vcontent parameter, related to the site name...

Design/Logic Flaw

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

CVE-2018-16343

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

CVE-2018-16343

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf in include/main.class.php does not block use of $GLOBALS...

CVE-2018-16348

SeaCMS V6.61 has XSS via the adminvideo.php vcontent parameter, related to the site name...

CVE-2018-16343

SeaCMS 6.61 contains a remote code execution flaw: the parseIf() function in include/main.class.php fails to block use of $GLOBALS, enabling attackers to run arbitrary code. This has been documented across multiple sources (CNVD-2018-19075 and NVD/NVD-derived entries) and is tied to SeaCMS’s PHP ...

CVE-2018-16348

SeaCMS v6.61 suffers a cross-site scripting (XSS) vulnerability in admin_video.php via the v_content parameter related to the site name. According to CNVD-2018-19071, remote attackers can exploit this to inject arbitrary web script or HTML. There is no remediation or patch information provided in...