CVE-2018-12943

SeedDMS before 5.1.8 contains a cross-site scripting (XSS) vulnerability via the action URL parameter on every page that includes it, allowing remote attackers to inject arbitrary script or HTML. The issue is described consistently across multiple sources (NVD/CNVD), with the affected version ran...

CVE-2018-12941

SeedDMS is affected by a remote code execution/command injection vulnerability (CVE-2018-12941) prior to version 5.1.8. An authenticated user with Settings permissions can manipulate the Cache directory path (cacheDir) to inject arbitrary system commands via the Clear Cache workflow, enabling exe...

CVE-2018-12943

Cross-Site Scripting XSS vulnerability in every page that includes the "action" URL parameter in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2018-12939

A directory traversal flaw in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows an authenticated attacker to write to or potentially delete arbitrary files via a .. dot dot in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using...

CVE-2018-12940

SeedDMS before 5.1.8 has an unrestricted file upload in the file op/op.UploadChunks.php (parameter qqfile ). An authenticated attacker can upload a file with an executable extension, upload a malicious PHP payload, and execute OS commands from the web root. This vulnerability is documented as CVE...

CVE-2018-12944

Persistent Cross-Site Scripting XSS vulnerability in the "Categories" feature in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the name field...

CVE-2018-12942

SQL injection vulnerability in the "Users management" functionality in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows authenticated attackers to manipulate an SQL query within the application by sending additional SQL commands to the application server. An attacker can use this...

CVE-2018-12942

SeedDMS (formerly LetoDMS/MyDMS) contains a SQL injection vulnerability in the Users management feature affecting versions before 5.1.8 . The flaw allows authenticated attackers to manipulate SQL queries on the application server, enabling extraction, modification, or deletion of data in the back...

CVE-2018-12944

SeedDMS (formerly LetoDMS/MyDMS) is affected by a persistent XSS in the Categories feature. The vulnerability is in the name field and affects SeedDMS versions prior to 5.1.8. Exploitation details are not provided in the available documents.

CVE-2014-2279

Multiple directory traversal vulnerabilities in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allow 1 remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. dot dot in the logname parameter to out/out.LogManagement.php or 2 remote attackers to...

CVE-2014-2278

Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it...

Unrestricted file upload

Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it...

Directory traversal

Multiple directory traversal vulnerabilities in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allow 1 remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. dot dot in the logname parameter to out/out.LogManagement.php or 2 remote attackers to...

CVE-2014-2279

CVE-2014-2279 and CVE-2014-2278 affect SeedDMS (formerly LetoDMS/MyDMS) up to version 4.3.3. CVE-2014-2279: Directory traversal via logname in /out/out.LogManagement.php allows read access to arbitrary local files for remote authenticated users with LogManagement access. CVE-2014-2278: Unrestrict...

CVE-2014-2279

Multiple directory traversal vulnerabilities in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allow 1 remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. dot dot in the logname parameter to out/out.LogManagement.php or 2 remote attackers to...

CVE-2014-2278

Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the partitionIndex parameter and leveraging CVE-2014-2279.2 to access it...

CVE-2014-2278

SeedDMS (formerly LetoDMS/MyDMS) before 4.3.4 has an unrestricted file upload in op/op.AddFile2.php. An attacker can specify an executable extension via partitionIndex and, using CVE-2014-2279’s path traversal in fileId, upload and later access the file to gain remote code execution. The issue is...

Multiple Vulnerabilities in SeedDMS < = 4.3.3

Product description: ============ SeedDMS is the continuation of LetoDMS because it has lost its main developer. SeedDMS is an easy to use but powerful Open Source Document Management System. http://www.seeddms.org/index.php?id=2 ============ SeedDMS Unprivileged User Remote Code Execution...

CVE-2014-2280

Cross-site scripting XSS vulnerability in the search feature in SeedDMS formerly LetoDMS and MyDMS before 4.3.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...

CVE-2014-2280

SeedDMS (formerly LetoDMS/MyDMS) before version 4.3.4 is affected by a reflected XSS in the search feature. The vulnerability arises from the query parameter used by the search, allowing attackers to inject arbitrary scripts/HTML that are returned without proper validation or sanitization. Public...