CVE-2023-37124

CVE-2023-37124 is a stored XSS vulnerability in SEACMS v12.1, specifically in the Site Setup module. The issue allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. Affected component: Site Setup module of SEACMS v12.1. Root cause and impact: stored XSS with potential...

CVE-2023-37125

CVE-2023-37125 affects SEACMS v12.1, with a stored XSS in the Management Custom label module allowing crafted payloads to execute arbitrary client-side scripts. CVSSv3.1 base score 5.4 (Medium) with UI:R, Privileges: LOW, Attack Vector: Network. Connected sources confirm the affected component an...

CVE-2023-44172

SeaCMS 12.9 contains an arbitrary file write vulnerability in the admin_weixin.php component. The CVE-2023-44172 entry is supported by multiple sources (NVD, Red Hat, CNNVD, cve.org/etc.), citing a high-severity issue with CVSS 3.1 base score 9.8 (CRITICAL) and a network-exposed, no-auth, high-im...

CVE-2022-23878

CVE-2022-23878 affects seacms V11.5 with an arbitrary code execution vulnerability in admin_config.php. Multiple connected sources confirm that an attacker can write malicious files to the site and execute commands, leading to full impact on affected installations. CVSS data from NVD indicates hi...

CVE-2024-31611

SeaCMS 12.9 is affected by CVE-2024-31611 due to a file deletion vulnerability in admin_template.php. The CVSS v3.1 base score is 9.1 (CRITICAL) with Network access, Low complexity, NONE privileges, no user interaction, and impacts to integrity and availability (I:H, A:H). The connected sources c...

CVE-2023-44170

CVE-2023-44170 affects SeaCMS v12.9, via the admin_ping.php component, enabling an arbitrary file write. The issue is classified with CVSS 3.1 base score 9.8 (CRITICAL) with network attack vector, low complexity, no privileges required, and requires no user interaction; impact to confidentiality,...

CVE-2025-25514

The SeaCMS content management system, specifically versions

CVE-2023-46987

CVE-2023-46987 affects SeaCMS v12.9 and is described as a remote code execution (RCE) vulnerability exploitable via the /augap/adminip.php component. The issue is consistently reported across multiple sources (NVD, Red Hat, CNNVD, PRION/Prio-n, CVE list, etc.) with SeaCMS v12.9 identified as vuln...

CVE-2023-44169

SeaCMS v12.9 is affected by CVE-2023-44169, a high-severity arbitrary file write vulnerability in the admin_notify.php component. The CVSSv3.1 base score is 9.8 (CRITICAL) with Network attack vector, no privileges required, and no user interaction. Impact spans confidentiality, integrity, and ava...

CVE-2022-28076

CVE-2022-28076 affects SeaCMS v11.6. The issue is a remote command execution (RCE) via the Mail Server Settings in SeaCMS’s code path. The connected records consistently describe SeaCMS 11.6 as vulnerable to RCE from mail server configuration, but do not provide precise technical details about th...

CVE-2025-3792

SeaCMS prior to version 13.4/13.3 is affected by a SQL injection in admin_link.php?action=delall via manipulation of the e_id parameter. The vulnerability is invoked remotely and exploitation has been publicly disclosed. Affected product: SeaCMS (≤13.3; some sources reference ≤13.4). Root cause d...

CVE-2025-25519

The open-source web content management system Seacms (version

CVE-2024-30565

SeaCMS version 12.9 is vulnerable to arbitrary code execution due to an issue in the admin notify.php endpoint. This vulnerability allows remote attackers to execute code on the target system. As a mitigation, it is recommended to disable access to the admin notify.php endpoint until a formal pat...

CVE-2025-25513

SeaCMS

CVE-2025-25800

SeaCMS version 13.3 is vulnerable to an arbitrary file read vulnerability within the file_get_contents function located in the admin_safe_file.php file. This flaw, characterized as a path traversal issue (CWE-22 ), could lead to the disclosure of sensitive information. As a temporary workaround, ...

CVE-2025-25799

SeaCMS version 13.3 is susceptible to an arbitrary file read vulnerability located in the admin_safe.php file. The flaw originates from the improper use of the file_get_contents function at the admin_safe.php endpoint, which could allow unauthorized access to sensitive files. As a temporary worka...

CVE-2025-25813

SeaCMS v13.3 is affected by a remote code execution (RCE) vulnerability located in the admin_files.php component. The root cause is identified as improper neutralization of special elements used in a command . This flaw allows an attacker to potentially execute arbitrary code on the target system...

CVE-2024-40519

CVE-2024-40519 affects SeaCMS 12.9. The vulnerability arises from admin_smtp.php directly splicing and writing user input into weixin.php without processing, enabling remote code execution. An authenticated attacker could run arbitrary commands and gain system permissions. Documented severity in ...

CVE-2024-39036

CVE-2024-39036 affects SeaCMS v12.9 and is described as an Arbitrary File Read via admin_safe.php. The vulnerability, with CVSS 3.1 base score 6.5 (Medium), has a network attack vector, low attack complexity, and requires low privileges with no user interaction, causing confidentiality impact to ...

CVE-2025-25796

The open-source web content management system SeaCMS v13.3 contains a remote code execution (RCE) vulnerability within the admin_template.php component. The root cause is identified as improper neutralization of special elements used in a command (Command Injection). This flaw allows for potentia...

CVE-2022-27336

Seacms v11.6 is affected by a remote code execution (RCE) vulnerability in the /admin/weixin.php component. The provided documents confirm an RCE in Seacms 11.6 but do not supply exploited vectors, exact root cause details, or explicit patch/version remediation within the citations. CVSS metrics ...

CVE-2025-44071

CVE-2025-44071 concerns SeaCMS v13.3 with a remote code execution (RCE) vulnerability in the phomebak.php component. The issue is described as an improper handling/exposure of phomebak.php that allows an attacker to execute arbitrary code via a crafted request. Impact is high (C/H/I/A = 9.8) with...

CVE-2025-25802

SeaCMS version 13.3 contains a Remote Code Execution (RCE) vulnerability located in the admin_ip.php component. The root cause is identified as Improper Neutralization of Special Elements used in a Command (CWE-77), which could allow an attacker to execute arbitrary code. To remediate this, users...

CVE-2025-25794

The open-source web content management system SeaCMS v13.3 is susceptible to a remote code execution (RCE) vulnerability within the admin_ping.php component. The root cause is identified as CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') , which allows ...

CVE-2025-44072

CVE-2025-44072 affects SeaCMS v13.3, with a SQL injection in the admin_manager.php component due to mishandling input. The CVSS v3.1 base score is 9.8 (CRITICAL), with NETWORK attack vector, LOW attack complexity, and no user interaction required. Impacts are HIGH on confidentiality, integrity, a...

CVE-2025-22974

A SQL Injection vulnerability exists in SeaCMS versions 13.2 and before . The root cause is the improper handling of the DoTranExecSql parameter within the phome.php component. This flaw allows a remote attacker to achieve arbitrary code execution , potentially leading to unauthorized actions on ...

CVE-2025-25793

SeaCMS v13.3 is susceptible to a remote code execution (RCE) vulnerability located in the admin_notify.php component. This flaw allows for potential code execution on the target system. As a remediation, users are advised to update to a newer version that includes a fix. If an immediate update is...

CVE-2025-3797

SeaCMS up to version 13.3 is affected by an SQL injection in /admin_topic.php?action=delall caused by manipulation of the e_id parameter. The vulnerability is exploitable remotely, and multiple sources confirm exploitation is disclosed publicly. Impact is SQL injection; exact affected build range...

CVE-2024-50808

SeaCms version 13.1 is vulnerable to code injection within the notification module of the member message notification module in the backend user module. The root cause is the unsafe handling of the "notify" variable in the admin_notify.php file. This vulnerability could allow an attacker to injec...

CVE-2025-25797

SeaCMS version 13.3 is susceptible to a remote code execution (RCE) vulnerability within the admin_smtp.php component. The vulnerability allows for potential code execution, which may pose a significant risk to the system. While the PT-2025-8718 report recommends updating to a version that includ...

CVE-2025-4256

CVE-2025-4256 affects SeaCMS 13.2 in the /admin_paylog.php handler. The cstatus parameter, when manipulated, enables cross-site scripting. The flaw is exploitable remotely, and the public exploit has been disclosed. References list SeaCMS 13.2 and the vulnerable file; no vendor-provided patch/ver...

CVE-2020-26642

CVE-2020-26642 concerns a cross-site scripting (XSS) vulnerability in the login page of SeaCMS version 11. The connected sources confirm the affected software is SeaCMS (Ocean CMS) and that the issue enables an attacker to inject arbitrary web script or HTML through the login interface. The docum...

CVE-2025-25516

Seacms versions prior to 13.3 are vulnerable to SQL Injection within the admin_paylog.php file. This vulnerability allows for the improper neutralization of special elements used in SQL commands, potentially leading to unauthorized data access or manipulation. To remediate this issue, users are r...

CVE-2025-25517

Seacms versions

CVE-2025-25520

Versions of Seacms prior to 13.3 are vulnerable to an SQL Injection flaw located in the admin_pay.php file. This vulnerability allows for the improper neutralization of special elements used in SQL commands, potentially leading to unauthorized access or manipulation of the database. To resolve th...

CVE-2025-25521

Seacms versions

CVE-2023-43222

CVE-2023-43222 affects SeaCMS v12.8, with an arbitrary code writing vulnerability in the file /jxz7g2/admin_ping.php . The incident is described as arbitrary code execution in SeaCMS 12.8, with a CVSS v3.1 base score of 9.8 (CRITICAL) , attack vector NETWORK, no user interaction, and privileges r...

CVE-2024-55461

SeaCMS versions

CVE-2025-25792

SeaCMS v13.3 contains a Remote Code Execution (RCE) vulnerability caused by the improper neutralization of special elements used in a command (CWE-77). The flaw exists in the isopen parameter at the admin_weixin.php endpoint, allowing an attacker to execute arbitrary code remotely. Practical cons...

CVE-2025-29647

SeaCMS v13.3 is affected by a SQL injection vulnerability (CWE-89) located in the admin_tempvideo.php component. An attacker could potentially exploit this flaw to interact with the underlying database. While no specific exploit code is provided in the documents, a proof-of-concept was sighted in...

CVE-2025-44073

SeaCMS v13.3 is vulnerable to a SQL injection vulnerability within the admin_comment_news.php component. The flaw allows for unauthorized interaction with the underlying database. To mitigate this risk, users are recommended to update to a version that addresses this specific vulnerability. Proof...

CVE-2024-44720

SeaCMS v13.1 is susceptible to an arbitrary file read vulnerability located within the admin_safe.php component. This flaw allows an attacker to read files from the server. While no specific exploit details or real-world incidents are documented, it is recommended to disable access to the admin_s...

CVE-2024-46640

SeaCMS version 13.2 is susceptible to a remote code execution (RCE) vulnerability within the sql.class.chp file. The root cause is that a specific check function is not executed during operation, which allows an attacker to write to the file via the MySQL slow query method. This vulnerability ena...

CVE-2024-54879

SeaCMS version 13.1 is susceptible to Incorrect Access Control due to a logic flaw. This vulnerability allows an attacker to exploit the system to recharge memberships indefinitely. Evidence from proof-of-concept documentation indicates that manipulating the gid parameter (e.g., setting it to 1) ...

CVE-2022-43256

SeaCms before v12.6 has a SQL injection vulnerability in the /js/player/dmplayer/dmku/index.php component. Root cause: unsafely constructed SQL queries allow unauthenticated attackers to inject payloads. Impact per sources is high across confidentiality, integrity, and availability (CVSS 3.1 base...

CVE-2023-43278

SeaCMS CVE-2023-43278 is a CSRF flaw in admin_manager.php affecting SeaCMS/Seacms up to version 12.8, enabling attackers to arbitrarily add an admin account. Root cause: CSRF in admin_manager.php. Impact: attacker could gain admin privileges; exploitation details are not provided in the documents...

CVE-2024-6416

SeaCMS 12.9 is affected by a remote SQL injection vulnerability in /js/player/dmplayer/dmku/?ac=edit, caused by manipulating the cid parameter (example payload: (select(0)from(select(sleep(10)))v)). Multiple trusted sources corroborate that this vulnerability can be exploited remotely and that th...

CVE-2024-42599

The open-source web content management system SeaCMS version 13.0 is vulnerable to remote code execution (RCE) . The root cause is a flaw in admin_files.php, where attackers can bypass existing restrictions on edited files to write and execute arbitrary code. This allows authenticated attackers t...

CVE-2024-54880

SeaCMS V13.1 is vulnerable to Incorrect Access Control due to a logic flaw. An unauthenticated attacker can exploit this vulnerability to register accounts in bulk . Proof-of-concept exploits have been published via Telegram. No specific remediation or patch version is provided in the documents.

CVE-2025-4257

SeaCMS 13.2 contains a cross-site scripting vulnerability in the /admin_pay.php handler caused by improper handling of the cstatus parameter. The issue can be triggered remotely and an exploit has been disclosed. At present, no official patch/version is stated in the provided documents. A documen...