CVE-2024-40520

SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by adminconfigmark.php directly splicing and writing the user input data into incphotowatermarkconfig.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrar...

CVE-2024-40518

Affected software/components: SeaCMS 12.9; vulnerable file: admin_weixin.php which writes user input directly into weixin.php without processing. Root cause / vulnerability type: Direct splicing/writing of unprocessed user input leading to remote code execution. Impact: Authenticated attackers ca...

CVE-2024-40522

CVE-2024-40522 affects SeaCMS 12.9. The root cause is phomebak.php writing unfiltered variable names into a PHP file, allowing an authenticated attacker to execute arbitrary commands and gain system permissions. Exploitation details are documented across multiple sources confirming remote code ex...

CVE-2024-40522

There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filtering them before writing them into the php file. An authenticated attacker can exploit this vulnerability to execute arbitrary commands and...

PT-2024-28895 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: The issue is caused by the admin smtp.php file directly splicing and writing user input data into weixin.php without processing it. This allows authenticated attackers to execute arbitrary commands and obtain...

CVE-2024-40518

SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by adminweixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain...

CVE-2024-40520

SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by adminconfigmark.php directly splicing and writing the user input data into incphotowatermarkconfig.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrar...

CVE-2024-40522

There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filtering them before writing them into the php file. An authenticated attacker can exploit this vulnerability to execute arbitrary commands and...

CVE-2024-40521

SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admintemplate.php imposes certain restrictions on the edited file, attackers can still bypass the restrictions and write code in some way, allowing authenticated attackers to exploit the...

CVE-2024-40519

SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by adminsmtp.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain...

CVE-2024-39028

An issue was discovered in SeaCMS =12.9 which allows remote attackers to execute arbitrary code via adminping.php...

CVE-2024-39028

An issue was discovered in SeaCMS =12.9 which allows remote attackers to execute arbitrary code via adminping.php...

CVE-2024-39027

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked...

CVE-2024-39027

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked...

CVE-2024-39027

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked...

CVE-2024-39028

SeaCMS <=12.9 is affected by a remote code execution flaw exploitable via admin_ping.php. The vulnerability stems from how admin_ping.php handles user input (directly spliced into ping.php), enabling arbitrary code execution on the server. Impact is high (CVE-2024-39028). Public references in ...

SeaCMS Security Vulnerability

SeaCMS is a free, open source web content management system written in PHP by SeaCMS, Inc. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS version 12.9, which stems from vulnerability to SQL injection attacks, which can lead to the...

CVE-2024-39028

An issue was discovered in SeaCMS =12.9 which allows remote attackers to execute arbitrary code via adminping.php...

PT-2024-28336 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: The issue is caused by an unauthorized SQL injection through the cid parameter at the "/js/player/dmplayer/dmku/index.php?ac=edit" API endpoint, which can lead to the leakage of sensitive database information...

CVE-2024-39027

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked...