Vulnerabilities

Filters

Reset all

1 selected

33 records

Sort

Vendor: Seeddms Clear all filters

TI-2025-28833 CVE-2025-45754 · GHSA-xmq3-c6r3-6cm9

A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32.

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00262 Published 2025-05-21 No fix listed CWE-79

TI-2025-28831 CVE-2025-45752 · GHSA-w34f-x9rj-jg28

A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute…

HIGH 67

A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the Extension Manager.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00593 Published 2025-05-21 No fix listed CWE-94

TI-2025-19011 CVE-2025-25461 · GHSA-hcjx-v7fg-j456

A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29.

MEDIUM 58

A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00517 Published 2025-02-28 No fix listed CWE-79

TI-2024-30953 CVE-2024-46409 · GHSA-hj4f-v7wh-wv79

A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter in the Calendar page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00336 Published 2024-10-04 No fix listed CWE-79

TI-2021-16759 CVE-2021-39421 · GHSA-gcxp-88pw-5248

A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00433 Published 2023-07-24 No fix listed CWE-79

TI-2021-16760 CVE-2021-39425 · GHSA-v867-c875-j3hh

SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability.

MEDIUM 60

SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00501 Published 2023-07-20 No fix listed CWE-601

TI-2021-12767 CVE-2021-33223 · GHSA-5r42-grwv-4wqj

An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the…

HIGH 73

An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00797 Published 2023-06-07 No fix listed CWE-639

TI-2022-22093 CVE-2022-44938 · GHSA-ghhq-5mmr-7wf5

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a…

HIGH 82

Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01008 Published 2022-12-08 No fix listed CWE-330

TI-2022-10877 CVE-2022-28051 · GHSA-3mhq-vj94-wvcw

The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version…

LOW 26

The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allows an attacker to inject malicious javascript code.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00837 Published 2022-06-06 No fix listed CWE-79

TI-2022-11193 CVE-2022-28478 · GHSA-jrvj-5hh7-vf4w

SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal.

LOW 32

SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.0153 Published 2022-06-06 No fix listed CWE-22

TI-2022-11194 CVE-2022-28479 · GHSA-j4vr-p2v7-rh48

SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS.

LOW 23

SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00594 Published 2022-06-06 No fix listed CWE-79

TI-2021-20514 CVE-2021-45408 · GHSA-xmmf-x347-442h

Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote…

LOW 28

Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sites using the "referuri" parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00647 Published 2022-02-04 No fix listed CWE-601

TI-2020-14444 CVE-2020-23048 · GHSA-r4pv-jfq7-qpmq

SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS)…

LOW 28

SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment parameters.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00725 Published 2021-10-22 No fix listed CWE-79

TI-2021-14792 CVE-2021-36543 · GHSA-ch3p-cc6q-rh44

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in…

LOW 21

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an aut…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00614 Published 2021-08-03 No fix listed CWE-352

TI-2021-14791 CVE-2021-36542 · GHSA-6mj3-q7xf-m4j8

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS…

LOW 21

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenti…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0055 Published 2021-08-03 No fix listed CWE-352

TI-2021-14176 CVE-2021-35343 · GHSA-f9r7-f29g-x3r3

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS…

LOW 21

Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated us…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00525 Published 2021-08-03 No fix listed CWE-352

TI-2021-08081 CVE-2021-26216 · GHSA-8wf3-f4x7-9h3c

SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.

LOW 21

SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00494 Published 2021-03-18 No fix listed CWE-352

TI-2021-08080 CVE-2021-26215 · GHSA-8v5p-26mr-crfq

SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.

LOW 21

SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00494 Published 2021-03-18 No fix listed CWE-352

TI-2020-17399 CVE-2020-28727 · GHSA-4rph-vm8p-q3q4

Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to…

LOW 28

Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00705 Published 2020-12-07 No fix listed CWE-79

TI-2020-17398 CVE-2020-28726 · GHSA-5cff-vfpf-qq5f

Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.

LOW 28

Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00649 Published 2020-11-24 No fix listed CWE-601

TI-2019-09681 CVE-2019-12932 · GHSA-w5fr-p5m9-6cjv

A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search…

LOW 29

A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in the header of out/out.Viewfolder.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00802 Published 2019-06-28 No fix listed CWE-79

TI-2019-09534 CVE-2019-12745 · GHSA-w5ch-6ww5-rv5w

out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.

LOW 29

out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02522 Published 2019-06-20 No fix listed CWE-79

TI-2019-09533 CVE-2019-12744 · GHSA-3xh3-2jvh-x9rr

SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file…

MEDIUM 46

SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940.

CVSS 3.0HIGH 7.5 Network Low privileges No interaction EPSS 0.11488 Published 2019-06-20 No fix listed CWE-434

TI-2019-09583 CVE-2019-12801 · GHSA-93vm-mvj5-x34x

out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a…

LOW 31

out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01918 Published 2019-06-17 No fix listed CWE-79

TI-2018-09305 CVE-2018-12944 · GHSA-26qr-5f59-55qh

Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in…

LOW 29

Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the name field.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01067 Published 2018-07-31 No fix listed CWE-79