CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-43222
https://notcve.org/view.php?id=CVE-2023-43222
SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file. SeaCMS v12.8 tiene una vulnerabilidad de escritura de código arbitrario en el archivo /jxz7g2/admin_ping.php. • https://blog.csdn.net/weixin_51394168/article/details/132817842 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-43278
https://notcve.org/view.php?id=CVE-2023-43278
A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account. Un Cross-Site Request Forgery (CSRF) en admin_manager.php de Seacms hasta v12.8 permite a los atacantes agregar arbitrariamente una cuenta de administrador. • http://seacms.com https://blog.csdn.net/sugaryzheng/article/details/133283101?spm=1001.2014.3001.5501 https://www.seacms.net • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-43256
https://notcve.org/view.php?id=CVE-2022-43256
SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php. Se descubrió que SeaCms anterior a v12.6 contenía una vulnerabilidad de inyección SQL a través del componente /js/player/dmplayer/dmku/index.php. • https://github.com/seacms-com/seacms/issues/23 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19349
https://notcve.org/view.php?id=CVE-2018-19349
In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php. En SeaCMS v6.64, hay una inyección SQL mediante el parámetro topic en admin_makehtml.php debido a la gestión incorrecta de include/mkhtml.func.php. • https://github.com/Xmansec/seacms_vul/blob/master/SQL/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19350
https://notcve.org/view.php?id=CVE-2018-19350
In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element. En SeaCMS v6.6.4, hay Cross-Site Scripting (XSS) persistente mediante el parámetro email en member.php?action=chgpwdsubmit durante un cambio de contraseña, tal y como queda demostrado con una URL data: en un elemento OBJECT. • https://github.com/Xmansec/seacms_vul/tree/master/XSS • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •