CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-43222
https://notcve.org/view.php?id=CVE-2023-43222
SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file. SeaCMS v12.8 tiene una vulnerabilidad de escritura de código arbitrario en el archivo /jxz7g2/admin_ping.php. • https://blog.csdn.net/weixin_51394168/article/details/132817842 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-43278
https://notcve.org/view.php?id=CVE-2023-43278
A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account. Un Cross-Site Request Forgery (CSRF) en admin_manager.php de Seacms hasta v12.8 permite a los atacantes agregar arbitrariamente una cuenta de administrador. • http://seacms.com https://blog.csdn.net/sugaryzheng/article/details/133283101?spm=1001.2014.3001.5501 https://www.seacms.net • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37125
https://notcve.org/view.php?id=CVE-2023-37125
A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. • https://github.com/seacms-com/seacms/issues/25 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37124
https://notcve.org/view.php?id=CVE-2023-37124
A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. • https://github.com/seacms-com/seacms/issues/24 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2926 – SeaCMS Picture Upload member.php denial of service
https://notcve.org/view.php?id=CVE-2023-2926
A vulnerability was found in SeaCMS 11.6 and classified as problematic. This issue affects some unknown processing of the file member.php of the component Picture Upload Handler. The manipulation of the argument oldpic leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://github.com/xryj920/CVE/blob/main/DEL.md https://vuldb.com/?ctiid.230081 https://vuldb.com/?id.230081 • CWE-404: Improper Resource Shutdown or Release •