CVE-2023-37124

CVE-2023-37124 is a stored XSS vulnerability in SEACMS v12.1, specifically in the Site Setup module. The issue allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. Affected component: Site Setup module of SEACMS v12.1. Root cause and impact: stored XSS with potential...

CVE-2023-37125

CVE-2023-37125 affects SEACMS v12.1, with a stored XSS in the Management Custom label module allowing crafted payloads to execute arbitrary client-side scripts. CVSSv3.1 base score 5.4 (Medium) with UI:R, Privileges: LOW, Attack Vector: Network. Connected sources confirm the affected component an...

CVE-2023-44172

SeaCMS 12.9 contains an arbitrary file write vulnerability in the admin_weixin.php component. The CVE-2023-44172 entry is supported by multiple sources (NVD, Red Hat, CNNVD, cve.org/etc.), citing a high-severity issue with CVSS 3.1 base score 9.8 (CRITICAL) and a network-exposed, no-auth, high-im...

CVE-2022-23878

CVE-2022-23878 affects seacms V11.5 with an arbitrary code execution vulnerability in admin_config.php. Multiple connected sources confirm that an attacker can write malicious files to the site and execute commands, leading to full impact on affected installations. CVSS data from NVD indicates hi...

CVE-2023-44170

CVE-2023-44170 affects SeaCMS v12.9, via the admin_ping.php component, enabling an arbitrary file write. The issue is classified with CVSS 3.1 base score 9.8 (CRITICAL) with network attack vector, low complexity, no privileges required, and requires no user interaction; impact to confidentiality,...

CVE-2023-44169

SeaCMS v12.9 is affected by CVE-2023-44169, a high-severity arbitrary file write vulnerability in the admin_notify.php component. The CVSSv3.1 base score is 9.8 (CRITICAL) with Network attack vector, no privileges required, and no user interaction. Impact spans confidentiality, integrity, and ava...

CVE-2025-25514

Seacms

CVE-2024-31611

SeaCMS 12.9 is affected by CVE-2024-31611 due to a file deletion vulnerability in admin_template.php. The CVSS v3.1 base score is 9.1 (CRITICAL) with Network access, Low complexity, NONE privileges, no user interaction, and impacts to integrity and availability (I:H, A:H). The connected sources c...

CVE-2025-25519

CVE-2025-25519 affects SeaCMS (SeaCMS

CVE-2025-25513

SeaCMS

CVE-2022-28076

CVE-2022-28076 affects SeaCMS v11.6. The issue is a remote command execution (RCE) via the Mail Server Settings in SeaCMS’s code path. The connected records consistently describe SeaCMS 11.6 as vulnerable to RCE from mail server configuration, but do not provide precise technical details about th...

CVE-2024-30565

SeaCMS 12.9 is affected by a remote code execution vulnerability exploitable via the admin notify.php endpoint. Public records confirm impact on SeaCMS and mention arbitrary code execution through this endpoint, but the provided documents do not specify a concrete exploit vector, affected version...

CVE-2025-25799

CVE-2025-25799 concerns SeaCMS 13.3, where an arbitrary file read vulnerability exists in the file_get_contents call within admin_safe.php. The root cause is improper handling of file access in that function, enabling reading unintended files. Impact per sources: confidentiality and integrity vio...

CVE-2020-26642

CVE-2020-26642 concerns a cross-site scripting (XSS) vulnerability in the login page of SeaCMS version 11. The connected sources confirm the affected software is SeaCMS (Ocean CMS) and that the issue enables an attacker to inject arbitrary web script or HTML through the login interface. The docum...

CVE-2022-27336

Seacms v11.6 is affected by a remote code execution (RCE) vulnerability in the /admin/weixin.php component. The provided documents confirm an RCE in Seacms 11.6 but do not supply exploited vectors, exact root cause details, or explicit patch/version remediation within the citations. CVSS metrics ...

CVE-2025-25800

CVE-2025-25800 affects SeaCMS 13.3. An arbitrary file read vulnerability exists in the file_get_contents function within admin_safe_file.php. The published descriptions indicate this enables disclosure of sensitive information through unintended file access. Several sources (NVD, Red Hat, CVE lis...

CVE-2025-25796

SeaCMS v13.3 is affected by a remote code execution (RCE) flaw in the admin_template.php component. The vulnerability is documented across multiple sources as CVE-2025-25796. The available descriptions consistently identify SeaCMS 13.3 and the admin_template.php module as the entry point for the ...

CVE-2025-25813

CVE-2025-25813 affects SeaCMS v13.3, with a remote code execution vulnerability in the admin_files.php component. Multiple connected sources corroborate an RCE in SeaCMS 13.3 via that component. The documents do not provide further technical details such as affected versions beyond v13.3, explici...

CVE-2025-25520

CVE-2025-25520 affects SeaCMS, specifically version 13.3, with a vulnerability in admin_pay.php that allows SQL injection. The available sources describe the vulnerable component and the underlying issue as an SQL injection in that PHP file; no explicit exploitation details or patch/version to re...

CVE-2025-44071

CVE-2025-44071 concerns SeaCMS v13.3 with a remote code execution (RCE) vulnerability in the phomebak.php component. The issue is described as an improper handling/exposure of phomebak.php that allows an attacker to execute arbitrary code via a crafted request. Impact is high (C/H/I/A = 9.8) with...

CVE-2025-44072

CVE-2025-44072 affects SeaCMS v13.3, with a SQL injection in the admin_manager.php component due to mishandling input. The CVSS v3.1 base score is 9.8 (CRITICAL), with NETWORK attack vector, LOW attack complexity, and no user interaction required. Impacts are HIGH on confidentiality, integrity, a...

CVE-2025-25516

CVE-2025-25516 affects SeaCMS

CVE-2025-25802

SeaCMS v13.3 is vulnerable to remote code execution via the admin_ip.php component. The flaw stems from the admin_ip.php path, with confirmed RCE impact in SeaCMS 13.3. No exploit details are provided in the documents; remediation guidance from connected sources suggests upgrading SeaCMS to a new...

CVE-2025-3797

SeaCMS up to version 13.3 is affected by an SQL injection in /admin_topic.php?action=delall caused by manipulation of the e_id parameter. The vulnerability is exploitable remotely, and multiple sources confirm exploitation is disclosed publicly. Impact is SQL injection; exact affected build range...

CVE-2025-22974

CVE-2025-22974 exposes a SQL injection in SeaCMS (versions 13.2 and earlier) via the DoTranExecSql parameter in phome.php, enabling a remote attacker to execute arbitrary code. The issue is tied to improper handling of the DoTranExecSql input, as described across multiple sources (NVD/NIST, Red H...

CVE-2025-25517

CVE-2025-25517 affects SeaCMS/Seacms versions up to 13.3, with a SQL Injection vulnerability in admin_reslib.php. The CVSSv3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-accessible, unauthenticated, no-user-interaction, high-impact flaw, affecting confidentiality, integrity,...

CVE-2025-3792

SeaCMS prior to version 13.4/13.3 is affected by a SQL injection in admin_link.php?action=delall via manipulation of the e_id parameter. The vulnerability is invoked remotely and exploitation has been publicly disclosed. Affected product: SeaCMS (≤13.3; some sources reference ≤13.4). Root cause d...

CVE-2025-25793

SeaCMS v13.3 contains a remote code execution (RCE) vulnerability in the admin_notify.php component. The CVE-2025-25793 entry states this affects SeaCMS v13.3 and identifies an RCE impact with a CVSS 3.1 base score of 5.1 (Medium). Attack vector is LOCAL with Low attack complexity, requiring HIGH...

CVE-2025-25797

CVE-2025-25797 : SeaCMS v13.3 contains a remote code execution (RCE) vulnerability exploitable through the admin_smtp.php component. Multiple connected sources corroborate an RCE in SeaCMS v13.3, but the provided documents do not detail affected versions beyond v13.3, nor do they specify patches,...

CVE-2025-25521

CVE-2025-25521 affects SeaCMS

CVE-2025-25792

SeaCMS v13.3 has a remote code execution (RCE) vulnerability via the isopen parameter in admin_weixin.php. Documentation confirms SeaCMS v13.3 is affected; no exploit details or fixes are provided in the connected sources. Remediation/patch information is not available in the supplied documents.

CVE-2025-4256

CVE-2025-4256 affects SeaCMS 13.2 in the /admin_paylog.php handler. The cstatus parameter, when manipulated, enables cross-site scripting. The flaw is exploitable remotely, and the public exploit has been disclosed. References list SeaCMS 13.2 and the vulnerable file; no vendor-provided patch/ver...

CVE-2025-25794

SeaCMS v13.3 is affected by CVE-2025-25794, described as a remote code execution (RCE) vulnerability via the component admin_ping.php. The connected documents confirm the vulnerability exists but do not provide exploit details, affected patch versions beyond SeaCMS v13.3, or remediation guidance....

CVE-2025-44073

SeaCMS v13.3 is affected by a SQL injection in the admin_comment_news.php component. The vulnerability allows unauthenticated, network-based exploitation with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8, CRITICAL). Root cause details are not elaborated beyond the SQ...

CVE-2023-43278

SeaCMS CVE-2023-43278 is a CSRF flaw in admin_manager.php affecting SeaCMS/Seacms up to version 12.8, enabling attackers to arbitrarily add an admin account. Root cause: CSRF in admin_manager.php. Impact: attacker could gain admin privileges; exploitation details are not provided in the documents...

CVE-2024-50808

SeaCms 13.1 is vulnerable to code injection in the backend user module’s notification flow (member message notification) due to unsafe handling of the notify variable in admin_notify.php. The concrete affected component is the notification module within the backend user area; root cause is improp...

CVE-2024-55461

CVE-2024-55461 affects SeaCMS

CVE-2024-44720

SeaCMS v13.1 is affected by an arbitrary file read in the admin_safe.php component. The vulnerability exposes file contents and is described across Red Hat/NVD/CNNVD/CVE records, with the issue scoped to SeaCMS 13.1 and the admin_safe.php handler. The CVSS 3.1 base scores indicate HIGH confidenti...

CVE-2025-44074

SeaCMS v13.3 contains a SQL injection vulnerability in the admin_topic.php component. The CVE-2025-44074 entry tracks a high-severity issue (CVSS v3.1: 9.8, NETWORK attack, no authentication, user interaction required none; impacts Confidentiality, Integrity, Availability are High) with exploitat...

CVE-2024-54880

CVE-2024-54880 affects SeaCMS V13.1. The vulnerability is an Incorrect Access Control that enables a logic flaw, allowing any user to register accounts in bulk. Documented impact is high (CVSS 3.1: 9.1, CRITICAL) with network attack vector and no user interaction required. Connected sources consi...

CVE-2025-29647

SeaCMS v13.3 contains a SQL injection vulnerability in the admin_tempvideo.php component. Root cause: improper handling of input in that PHP file leads to unauthenticated, remote exploitation with full impact on confidentiality, integrity, and availability (per CVSS 3.1 score 9.8). Exploitation a...

CVE-2025-4257

SeaCMS 13.2 contains a cross-site scripting vulnerability in the /admin_pay.php handler caused by improper handling of the cstatus parameter. The issue can be triggered remotely and an exploit has been disclosed. At present, no official patch/version is stated in the provided documents. A documen...

CVE-2022-43256

SeaCms before v12.6 has a SQL injection vulnerability in the /js/player/dmplayer/dmku/index.php component. Root cause: unsafely constructed SQL queries allow unauthenticated attackers to inject payloads. Impact per sources is high across confidentiality, integrity, and availability (CVSS 3.1 base...

CVE-2024-44683

Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php. The CVE entry documents an XSS in SeaCMS v13 (admin-video.php) with a CVSS v3.1 base score 6.1 (MEDIUM). Exploitation details are not fully disclosed in the provided materials; CVSS suggests network access with user inter...

CVE-2023-43222

CVE-2023-43222 affects SeaCMS v12.8, with an arbitrary code writing vulnerability in the file /jxz7g2/admin_ping.php . The incident is described as arbitrary code execution in SeaCMS 12.8, with a CVSS v3.1 base score of 9.8 (CRITICAL) , attack vector NETWORK, no user interaction, and privileges r...

CVE-2024-40519

CVE-2024-40519 affects SeaCMS 12.9. The vulnerability arises from admin_smtp.php directly splicing and writing user input into weixin.php without processing, enabling remote code execution. An authenticated attacker could run arbitrary commands and gain system permissions. Documented severity in ...

CVE-2024-40518

Affected software/components: SeaCMS 12.9; vulnerable file: admin_weixin.php which writes user input directly into weixin.php without processing. Root cause / vulnerability type: Direct splicing/writing of unprocessed user input leading to remote code execution. Impact: Authenticated attackers ca...

CVE-2024-42599

Summary of CVE-2024-42599 : SeaCMS 13.0 contains a remote code execution vulnerability due to improper restrictions on editing files (admin_files.php). Attackers can bypass these restrictions and write code, enabling authenticated attackers to execute arbitrary commands and gain system privileges...

CVE-2025-25515

Seacms

CVE-2020-21378

SeaCMS 10.1 (2020.02.08) is affected by a SQL injection vulnerability in the edit action of admin_members_group.php, exploitable via the id parameter. The issue is documented across multiple sources as a SQL injection in SeaCMS 10.1, with root cause being unsafely constructed SQL in the edit work...