114 matches found
CVE-2023-37124
CVE-2023-37124 is a stored XSS vulnerability in SEACMS v12.1, specifically in the Site Setup module. The issue allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. Affected component: Site Setup module of SEACMS v12.1. Root cause and impact: stored XSS with potential...
CVE-2023-37125
CVE-2023-37125 affects SEACMS v12.1, with a stored XSS in the Management Custom label module allowing crafted payloads to execute arbitrary client-side scripts. CVSSv3.1 base score 5.4 (Medium) with UI:R, Privileges: LOW, Attack Vector: Network. Connected sources confirm the affected component an...
CVE-2023-44172
SeaCMS 12.9 contains an arbitrary file write vulnerability in the admin_weixin.php component. The CVE-2023-44172 entry is supported by multiple sources (NVD, Red Hat, CNNVD, cve.org/etc.), citing a high-severity issue with CVSS 3.1 base score 9.8 (CRITICAL) and a network-exposed, no-auth, high-im...
CVE-2022-23878
CVE-2022-23878 affects seacms V11.5 with an arbitrary code execution vulnerability in admin_config.php. Multiple connected sources confirm that an attacker can write malicious files to the site and execute commands, leading to full impact on affected installations. CVSS data from NVD indicates hi...
CVE-2023-44170
CVE-2023-44170 affects SeaCMS v12.9, via the admin_ping.php component, enabling an arbitrary file write. The issue is classified with CVSS 3.1 base score 9.8 (CRITICAL) with network attack vector, low complexity, no privileges required, and requires no user interaction; impact to confidentiality,...
CVE-2024-31611
SeaCMS 12.9 is affected by CVE-2024-31611 due to a file deletion vulnerability in admin_template.php. The CVSS v3.1 base score is 9.1 (CRITICAL) with Network access, Low complexity, NONE privileges, no user interaction, and impacts to integrity and availability (I:H, A:H). The connected sources c...
CVE-2023-46987
CVE-2023-46987 affects SeaCMS v12.9 and is described as a remote code execution (RCE) vulnerability exploitable via the /augap/adminip.php component. The issue is consistently reported across multiple sources (NVD, Red Hat, CNNVD, PRION/Prio-n, CVE list, etc.) with SeaCMS v12.9 identified as vuln...
CVE-2023-44169
SeaCMS v12.9 is affected by CVE-2023-44169, a high-severity arbitrary file write vulnerability in the admin_notify.php component. The CVSSv3.1 base score is 9.8 (CRITICAL) with Network attack vector, no privileges required, and no user interaction. Impact spans confidentiality, integrity, and ava...
CVE-2022-28076
CVE-2022-28076 affects SeaCMS v11.6. The issue is a remote command execution (RCE) via the Mail Server Settings in SeaCMS’s code path. The connected records consistently describe SeaCMS 11.6 as vulnerable to RCE from mail server configuration, but do not provide precise technical details about th...
CVE-2024-30565
An issue exists in SeaCMS version 12.9 , a PHP-based web content management system primarily used for video-on-demand resources. The vulnerability allows remote attackers to achieve arbitrary code execution via the admin notify.php endpoint. While no specific patch version is listed, it is recomm...
CVE-2025-3792
SeaCMS prior to version 13.4/13.3 is affected by a SQL injection in admin_link.php?action=delall via manipulation of the e_id parameter. The vulnerability is invoked remotely and exploitation has been publicly disclosed. Affected product: SeaCMS (≤13.3; some sources reference ≤13.4). Root cause d...
CVE-2025-25799
SeaCMS version 13.3 contains an arbitrary file read vulnerability located in the admin_safe.php file. The root cause is identified as the improper use of the file_get_contents function at the admin_safe.php endpoint. This vulnerability could allow an attacker to access sensitive files on the serv...
CVE-2025-25800
SeaCMS version 13.3 is vulnerable to an arbitrary file read vulnerability due to the improper limitation of a pathname to a restricted directory. The root cause is located in the file_get_contents function within the admin_safe_file.php file, which could lead to the disclosure of sensitive inform...
CVE-2025-44071
CVE-2025-44071 concerns SeaCMS v13.3 with a remote code execution (RCE) vulnerability in the phomebak.php component. The issue is described as an improper handling/exposure of phomebak.php that allows an attacker to execute arbitrary code via a crafted request. Impact is high (C/H/I/A = 9.8) with...
CVE-2024-39036
CVE-2024-39036 affects SeaCMS v12.9 and is described as an Arbitrary File Read via admin_safe.php. The vulnerability, with CVSS 3.1 base score 6.5 (Medium), has a network attack vector, low attack complexity, and requires low privileges with no user interaction, causing confidentiality impact to ...
CVE-2025-25813
SeaCMS version 13.3 is affected by a Remote Code Execution (RCE) vulnerability within the admin_files.php component. The root cause involves the improper neutralization of special elements used in a command , which allows for potential code execution. While there is no specific fix version curren...
CVE-2025-25796
SeaCMS v13.3 contains a remote code execution (RCE) vulnerability within the admin_template.php component. The root cause is identified as Improper Neutralization of Special Elements used in a Command , which could allow an attacker to execute arbitrary code on the server. To remediate this, user...
CVE-2022-27336
Seacms v11.6 is affected by a remote code execution (RCE) vulnerability in the /admin/weixin.php component. The provided documents confirm an RCE in Seacms 11.6 but do not supply exploited vectors, exact root cause details, or explicit patch/version remediation within the citations. CVSS metrics ...
CVE-2024-40519
CVE-2024-40519 affects SeaCMS 12.9. The vulnerability arises from admin_smtp.php directly splicing and writing user input into weixin.php without processing, enabling remote code execution. An authenticated attacker could run arbitrary commands and gain system permissions. Documented severity in ...
CVE-2025-25802
SeaCMS v13.3 is susceptible to a remote code execution (RCE) vulnerability originating from the admin_ip.php component. This flaw allows for potential code execution on the affected system. To remediate this issue, users should update to a newer version of SeaCMS that includes a fix or, as a temp...
CVE-2025-44072
CVE-2025-44072 affects SeaCMS v13.3, with a SQL injection in the admin_manager.php component due to mishandling input. The CVSS v3.1 base score is 9.8 (CRITICAL), with NETWORK attack vector, LOW attack complexity, and no user interaction required. Impacts are HIGH on confidentiality, integrity, a...
CVE-2020-26642
CVE-2020-26642 concerns a cross-site scripting (XSS) vulnerability in the login page of SeaCMS version 11. The connected sources confirm the affected software is SeaCMS (Ocean CMS) and that the issue enables an attacker to inject arbitrary web script or HTML through the login interface. The docum...
CVE-2025-22974
A SQL Injection vulnerability exists in SeaCMS version v.13.2 and before . The root cause is the improper handling of the DoTranExecSql parameter within the phome.php component. A remote attacker can exploit this flaw to achieve arbitrary code execution . While the vulnerability is documented acr...
CVE-2025-25793
The open-source content management system SeaCMS v13.3 is vulnerable to Remote Code Execution (RCE) via the admin_notify.php component. This flaw allows for potential arbitrary code execution on the server. To mitigate this risk, users are recommended to update to a newer version that contains a ...
CVE-2025-25797
SeaCMS version 13.3 is susceptible to a remote code execution (RCE) vulnerability within the admin_smtp.php component. This flaw allows an attacker to potentially execute arbitrary code on the server. While the vulnerability is confirmed to exist in the specified version, there is currently no in...
CVE-2025-3797
SeaCMS up to version 13.3 is affected by an SQL injection in /admin_topic.php?action=delall caused by manipulation of the e_id parameter. The vulnerability is exploitable remotely, and multiple sources confirm exploitation is disclosed publicly. Impact is SQL injection; exact affected build range...
CVE-2023-43222
CVE-2023-43222 affects SeaCMS v12.8, with an arbitrary code writing vulnerability in the file /jxz7g2/admin_ping.php . The incident is described as arbitrary code execution in SeaCMS 12.8, with a CVSS v3.1 base score of 9.8 (CRITICAL) , attack vector NETWORK, no user interaction, and privileges r...
CVE-2025-25517
The open-source web content management system SeaCMS (version
CVE-2025-25520
Seacms versions prior to 13.3 are vulnerable to a SQL Injection flaw located in the admin_pay.php file. This vulnerability allows an attacker to potentially execute unauthorized SQL queries against the backend database. While the CNNVD document notes that Seacms is an open-source PHP-based conten...
CVE-2025-25794
SeaCMS v13.3 is vulnerable to a remote code execution (RCE) flaw within the admin_ping.php component. The root cause is identified as the improper neutralization of special elements used in a command , which allows for potential arbitrary code execution. While specific exploit links are not provi...
CVE-2024-50808
The open-source web content management system SeaCms version 13.1 is vulnerable to code injection within the notification module of the member message notification module in the backend user module. The root cause is the unsafe handling of the notify variable in the admin_notify.php file. While t...
CVE-2025-4256
CVE-2025-4256 affects SeaCMS 13.2 in the /admin_paylog.php handler. The cstatus parameter, when manipulated, enables cross-site scripting. The flaw is exploitable remotely, and the public exploit has been disclosed. References list SeaCMS 13.2 and the vulnerable file; no vendor-provided patch/ver...
CVE-2025-25792
The SeaCMS v13.3 web content management system is vulnerable to Remote Code Execution (RCE) due to a flaw in the isopen parameter located at the admin_weixin.php endpoint. An attacker can exploit this vulnerability to execute arbitrary code remotely. To mitigate the risk, it is recommended to res...
CVE-2025-44073
SeaCMS v13.3 is vulnerable to a SQL injection flaw within the admin_comment_news.php component. This vulnerability allows for the improper neutralization of special elements used in SQL commands, potentially leading to unauthorized database access or manipulation. To mitigate this risk, users are...
CVE-2025-29647
SeaCMS v13.3 is susceptible to a SQL injection vulnerability within the admin_tempvideo.php component. This flaw allows an attacker to potentially interfere with the backend database. As a mitigation, it is recommended to disable access to the admin_tempvideo.php component until a formal patch is...
CVE-2022-43256
SeaCms before v12.6 has a SQL injection vulnerability in the /js/player/dmplayer/dmku/index.php component. Root cause: unsafely constructed SQL queries allow unauthenticated attackers to inject payloads. Impact per sources is high across confidentiality, integrity, and availability (CVSS 3.1 base...
CVE-2024-54879
SeaCMS V13.1 is vulnerable to Incorrect Access Control due to a logic flaw that allows any user to recharge memberships indefinitely. Exploitation involves interacting with the Super Member section and modifying the gid parameter to 1; if the system validates this change, it successfully adds mem...
CVE-2023-43278
SeaCMS CVE-2023-43278 is a CSRF flaw in admin_manager.php affecting SeaCMS/Seacms up to version 12.8, enabling attackers to arbitrarily add an admin account. Root cause: CSRF in admin_manager.php. Impact: attacker could gain admin privileges; exploitation details are not provided in the documents...
CVE-2024-44683
Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php. The CVE entry documents an XSS in SeaCMS v13 (admin-video.php) with a CVSS v3.1 base score 6.1 (MEDIUM). Exploitation details are not fully disclosed in the provided materials; CVSS suggests network access with user inter...
CVE-2024-44720
SeaCMS v13.1 is susceptible to an arbitrary file read vulnerability originating from the admin_safe.php component. This flaw allows an attacker to potentially access restricted files on the server. While there is currently no information regarding a patch or a newer version containing a fix, it i...
CVE-2025-4257
SeaCMS 13.2 contains a cross-site scripting vulnerability in the /admin_pay.php handler caused by improper handling of the cstatus parameter. The issue can be triggered remotely and an exploit has been disclosed. At present, no official patch/version is stated in the provided documents. A documen...
CVE-2024-46640
The SeaCMS 13.2 web content management system is vulnerable to remote code execution (RCE) due to a flaw in the sql.class.chp file. The vulnerability occurs because a security check function is not executed during execution, which allows an attacker to write to a file via the MySQL slow query met...
CVE-2024-54880
SeaCMS version 13.1 is vulnerable to an Incorrect Access Control flaw. A logic vulnerability allows an attacker to bypass standard restrictions to register accounts in bulk . Proof-of-concept exploitations have been published via Telegram. No specific remediation or patch version is provided in t...
CVE-2023-0960
SeaCMS 11.6’s Picture Management module contains a deserialization vulnerability in the /data/config.ftp.php path that can be triggered remotely. Public exploit details exist, and the issue affects the specified file/functionality rather than a generic component. No official patch/fix is document...