CVE-2026-82601 SeaCMS err.php cross site scripting

A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for...

CVE-2026-82601

SeaCMS versions up to 13.6 are affected by a reflected cross-site scripting (XSS) vulnerability in the /err.php file. By manipulating the errtxt parameter, a remote attacker can inject malicious script that executes in the victim's browser upon interaction. The attack requires user interaction bu...

CVE-2026-82600

SeaCMS up to version 13.6 is affected by a SQL injection vulnerability in the file /zyapi.php?ac=videolist, specifically through manipulation of the ids argument. The flaw allows remote, unauthenticated attackers to execute arbitrary SQL queries with low complexity . The impact is rated HIGH (7.3...

EUVD-2026-68305

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-82600 SeaCMS zyapi.php sql injection

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-82599 SeaCMS Avatar Upload member.php unlink path traversal

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

CVE-2026-82599

SeaCMS versions up to 13.6 are affected by a path traversal vulnerability in the Avatar Upload component. The flaw resides in the unlink function of /member.php?action=chgpwdsubmit, where manipulation of the oldpic argument allows a remote attacker with low privileges to delete arbitrary files. T...

EUVD-2026-68302

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

EUVD-2026-68301

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclose...

CVE-2026-82598 SeaCMS Template search.php parseIf code injection

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclose...

CVE-2026-82598

SeaCMS versions up to 13.6 contain a code injection vulnerability in the Template Engine component, specifically in the parseIf function within search.php . An attacker can remotely manipulate the searchtype argument without authentication to inject arbitrary code. The CVSS 3.1 score is 7.3 (HIGH...

CVE-2020-36932

SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded...

CVE-2020-36932

SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded...

CVE-2020-36932

SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded...

CVE-2020-36932 Seacms 11.1 - 'checkuser' Stored XSS

SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded...

CVE-2020-36932 Seacms 11.1 - 'checkuser' Stored XSS

SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded...

CVE-2020-36932

CVE-2020-36932 affects SeaCMS 11.1. The vulnerability is a stored cross-site scripting (XSS) in the checkuser parameter of the admin settings page. The underlying issue allows an attacker to inject JavaScript payloads that execute in users’ browsers when the page loads. Affected component: admin ...

EUVD-2026-4635

SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded...

SeaCMS cross-site scripting vulnerabilities

SeaCMS is a free, open-source website content management system developed using PHP by the company Ocean CMS. This system is primarily designed for managing video on-demand resources. Version 11.1 of SeaCMS contains a cross-site scripting vulnerability, which stems from improper cleaning of the...

PT-2026-4650

SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded...