Design/Logic Flaw

SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu...

Cross site scripting

The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code...

Directory traversal

SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system...

CVE-2022-28051

The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code...

CVE-2022-28051

SeedDMS versions 6.0.18 and 5.1.25 are affected by a stored XSS in the Add category function of the Global Keywords menu. The vulnerability arises when user-supplied input is stored and later reflected in the UI, enabling injection of JavaScript. Documented by NVD as CVE-2022-28051 with CVSS v3.1...

CVE-2022-28478

SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system...

CVE-2022-28478

SeedDMS vulnerability CVE-2022-28478 affects SeedDMS 6.0.17 and 5.1.24. The issue is a directory traversal in the Remove file function within Log files management, where user input is not sanitized. This permits an attacker with admin privileges to delete arbitrary files on the remote system. No ...

CVE-2022-28479

SeedDMS versions 6.0.18 and 5.1.25 and below are affected by a stored XSS vulnerability. An attacker with admin privileges can inject a payload via the Role management UI and trigger it by loading the Users management menu, as described in multiple sources for CVE-2022-28479. The affected compone...

CVE-2022-28479

SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu...

SeedDMS 跨站脚本漏洞

SeedDMS formerly known as LetoDMS and MyDMS is a PHP and MySql based document management system used to store and share documents. SeedDMS versions 6.0.18 and 5.1.25 contain a cross-site scripting vulnerability that stems from the Add category function in the Global Keyword menu, which is prone t...

SeedDMS 路径遍历漏洞

SeedDMS formerly known as LetoDMS and MyDMS is a set of open source document management system based on PHP and MySql . The system is mainly used for storing and sharing documents. A security vulnerability exists in SeedDMS version 6.0.17 and version 5.1.24, which is caused by a directory travers...

SeedDMS 跨站脚本漏洞

SeedDMS formerly known as LetoDMS and MyDMS is a PHP and MySql based document management system. A cross-site scripting vulnerability exists in SEEDMS versions 6.0.18 and 5.1.25, which are primarily used to store and share documents. The vulnerability can be exploited to inject a payload into the...

CVE-2021-45408

Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter...

CVE-2021-45408

Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter...

CVE-2021-45408

Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter...

Open redirect

Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter...

CVE-2021-45408

SeedDMS 6.0.15 contains an Open Redirect vulnerability in out.Login.php that can be triggered via the referuri parameter, enabling remote attackers to redirect authenticated users to a malicious site. The CVE description and supporting records across NVD, CVE List, PRION, and CNNVD corroborate th...

CVE-2021-45408

Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter...

SeedDMS 输入验证错误漏洞

SeedDMS formerly known as LetoDMS and MyDMS is a set of open source document management system based on PHP and MySql . The system is primarily used for storing and sharing documents. SeedDMS suffers from an input validation error vulnerability that stems from an open redirection vulnerability in...

SeedDMS cross-site scripting vulnerability (CNVD-2022-05448)

SeedDMS is a free document management system with an easy-to-use web-based user interface. A cross-site scripting vulnerability exists in the AddEvent.php component in SeedDMS version 6.0.7. The vulnerability can be exploited to inject malicious script code via the name and comment parameters...