CVE-2019-12744

SeedDMS before 5.1.11 allows Remote Command Execution RCE because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940...

Design/Logic Flaw

SeedDMS before 5.1.11 allows Remote Command Execution RCE because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940...

Cross site scripting

out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting XSS via the name field...

CVE-2019-12745

out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting XSS via the name field...

CVE-2019-12745

SeedDMS contains a Stored XSS vulnerability in out/out.UsrMgr.php exploited via the name field, affecting versions before 5.1.11. The issue is documented across multiple sources (CVE-2019-12745, Red Hat advisory, Exploit-DB records) and involves injecting script code in user-name handling during ...

CVE-2019-12744

SeedDMS prior to 5.1.11 is affected by CVE-2019-12744 due to an unvalidated file upload of PHP scripts, enabling Remote Command Execution over the network. The root cause is the upload of PHP-backdoor-like content into documents, allowing execution of arbitrary commands on the server when the upl...

CVE-2019-12744

SeedDMS before 5.1.11 allows Remote Command Execution RCE because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940...

SeedDMS Cross-Site Scripting Vulnerability (CNVD-2019-18509)

SeedDMS is a free document management system with an easy-to-use web-based user interface. A stored cross-site scripting vulnerability exists in out/out.GroupMgr.php in SeedDMS 5.1.11. An attacker can exploit this vulnerability by creating a new group with a JavaScript payload as the group name t...

CVE-2019-12801

out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name...

CVE-2019-12801

out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name...

Cross site scripting

out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name...

CVE-2019-12801

SeedDMS 5.1.11 is vulnerable to a Stored XSS in out/out.GroupMgr.php where creating a new group with a JavaScript payload as the GROUP name leads to script execution. Public PoC demonstrates inserting [removed] tags in the group name. The available sources confirm the affected component and the n...

CVE-2019-12801

out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name...

SeedDMS Path Traversal Vulnerability

SeedDMS formerly known as LetoDMS and MyDMS is SeedDMS enthusiasts jointly developed a set of PHP and MySql-based open source document management system . The system is mainly used to store and share documents. A directory traversal vulnerability exists in SeedDMS versions prior to 5.1.8. An...

SeedDMS SQL Injection Vulnerability

SeedDMS formerly known as LetoDMS and MyDMS is SeedDMS enthusiasts jointly developed a set of PHP and MySql-based open source document management system . The system is mainly used to store and share documents. A SQL injection vulnerability exists in the 'Users management' feature in SeedDMS...

SeedDMS System Command Injection Vulnerability

SeedDMS formerly known as LetoDMS and MyDMS is SeedDMS enthusiasts jointly developed a set of PHP and MySql-based open source document management system . The system is mainly used to store and share documents. A system command injection vulnerability exists in SeedDMS versions prior to 5.1.8. An...

SeedDMS Cross-Site Scripting Vulnerability

SeedDMS formerly known as LetoDMS and MyDMS is SeedDMS enthusiasts jointly developed a set of PHP and MySql-based open source document management system . The system is mainly used to store and share documents. A cross-site scripting vulnerability exists in SeedDMS versions prior to 5.1.8 on page...

SeedDMS Arbitrary File Upload Vulnerability

SeedDMS formerly known as LetoDMS and MyDMS is SeedDMS enthusiasts jointly developed a set of PHP and MySql-based open source document management system . The system is mainly used to store and share documents. An arbitrary file upload vulnerability exists in the 'op/op.UploadChunks.php' file in...

SeedDMS cross-site scripting vulnerability (CNVD-2018-17472)

SeedDMS formerly known as LetoDMS and MyDMS is SeedDMS enthusiasts jointly developed a set of PHP and MySql-based open source document management system . The system is mainly used to store and share documents. A cross-site scripting vulnerability exists in the 'Categories' feature in SeedDMS...

CVE-2018-12939

A directory traversal flaw in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows an authenticated attacker to write to or potentially delete arbitrary files via a .. dot dot in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using...