Priority HIGH 77
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00461 · Published 2026-10-22 · No fix listed CWE-89
Priority LOW 23
SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00278 · Published 2026-01-25 · No fix listed CWE-79
Priority MEDIUM 56
A vulnerability was found in SeaCMS up to 13.3.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00365 · Published 2025-12-21 · No fix listed CWE-74
Priority HIGH 70
A vulnerability has been found in SeaCMS up to 13.3.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00452 · Published 2025-12-21 · No fix listed CWE-74
Priority MEDIUM 56
An information disclosure vulnerability has been discovered in SeaCMS 13.1.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00367 · Published 2025-10-03 · No fix listed CWE-200
Priority MEDIUM 64
A security vulnerability has been detected in SeaCMS 13.3.20250820.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00345 · Published 2025-09-27 · No fix listed CWE-74
Priority MEDIUM 56
A vulnerability has been found in SeaCMS up to 13.3.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00414 · Published 2025-09-18 · No fix listed CWE-74
Priority MEDIUM 58
Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00211 · Published 2025-08-05 · No fix listed CWE-79
Priority MEDIUM 57
A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2.
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00274 · Published 2025-06-29 · No fix listed CWE-352
Priority MEDIUM 62
SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00418 · Published 2025-06-17 · No fix listed CWE-89
Priority MEDIUM 49
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00506 · Published 2025-05-06 · No fix listed CWE-89
Priority MEDIUM 56
A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00334 · Published 2025-05-05 · No fix listed CWE-79
Priority MEDIUM 56
A vulnerability classified as problematic was found in SeaCMS 13.2.
CVSS 4.0MEDIUM 5.1· Network · Low privileges · User interaction · EPSS 0.00324 · Published 2025-05-05 · No fix listed CWE-79
Priority MEDIUM 49
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00525 · Published 2025-05-05 · No fix listed CWE-89
Priority MEDIUM 49
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00525 · Published 2025-05-05 · No fix listed CWE-89
Priority MEDIUM 51
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01049 · Published 2025-05-05 · No fix listed CWE-94
Priority LOW 24
A vulnerability classified as critical was found in SeaCMS up to 13.3.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.0053 · Published 2025-04-19 · No fix listed CWE-74
Priority MEDIUM 56
A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00661 · Published 2025-04-18 · No fix listed CWE-74
Priority HIGH 82
SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00535 · Published 2025-04-03 · No fix listed CWE-89
Priority MEDIUM 58
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.
CVSS 3.1MEDIUM 5.1· Local · High privileges · No interaction · EPSS 0.00418 · Published 2025-02-26 · No fix listed CWE-77
Priority MEDIUM 58
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.
CVSS 3.1MEDIUM 5.1· Local · High privileges · No interaction · EPSS 0.00418 · Published 2025-02-26 · No fix listed CWE-77
Priority MEDIUM 63
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00493 · Published 2025-02-26 · No fix listed CWE-22
Priority MEDIUM 60
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.
CVSS 3.1MEDIUM 6.0· Local · High privileges · No interaction · EPSS 0.00243 · Published 2025-02-26 · No fix listed CWE-552
Priority MEDIUM 58
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.
CVSS 3.1MEDIUM 5.1· Local · High privileges · No interaction · EPSS 0.00418 · Published 2025-02-26 · No fix listed CWE-77
Priority MEDIUM 58
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.
CVSS 3.1MEDIUM 5.1· Local · High privileges · No interaction · EPSS 0.00418 · Published 2025-02-26 · No fix listed CWE-77
Load more
THREATIST.IORead the docs