CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-44848
https://notcve.org/view.php?id=CVE-2023-44848
10 Oct 2023 — An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component. Un problema en SeaCMS v.12.8 permite a un atacante ejecutar código arbitrario a través del componente admin_template.php. • https://blog.csdn.net/2301_79997870/article/details/133661890?spm=1001.2014.3001.5502 •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44846
https://notcve.org/view.php?id=CVE-2023-44846
10 Oct 2023 — An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component. Un problema en SeaCMS v.12.8 permite a un atacante ejecutar código arbitrario a través del componente admin_notify.php. • https://blog.csdn.net/2301_79997870/article/details/133365547?spm=1001.2014.3001.5501 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44171
https://notcve.org/view.php?id=CVE-2023-44171
26 Sep 2023 — SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php. Se descubrió que SeaCMS V12.9 contenía una vulnerabilidad de escritura de archivos arbitraria a través del componente admin_smtp.php. • https://github.com/H3ppo/vulnerabilities/blob/main/SeaCMS%20V12.9%20Arbitrary%20file%20write%20vulnerability.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-43216
https://notcve.org/view.php?id=CVE-2023-43216
26 Sep 2023 — SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php. Se descubrió que SeaCMS V12.9 contenía una vulnerabilidad de escritura de archivos arbitraria a través del componente admin_ip.php. • https://github.com/H3ppo/vulnerabilities/blob/main/SeaCMS%20V12.9%20Arbitrary%20file%20write%20vulnerability.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44170
https://notcve.org/view.php?id=CVE-2023-44170
26 Sep 2023 — SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php. Se descubrió que SeaCMS V12.9 contenía una vulnerabilidad de escritura de archivos arbitraria a través del componente admin_ping.php. • https://github.com/H3ppo/vulnerabilities/blob/main/SeaCMS%20V12.9%20Arbitrary%20file%20write%20vulnerability.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44172
https://notcve.org/view.php?id=CVE-2023-44172
26 Sep 2023 — SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php. Se descubrió que SeaCMS V12.9 contenía una vulnerabilidad de escritura de archivos arbitraria a través del componente admin_weixin.php. • https://github.com/H3ppo/vulnerabilities/blob/main/SeaCMS%20V12.9%20Arbitrary%20file%20write%20vulnerability.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-44169
https://notcve.org/view.php?id=CVE-2023-44169
26 Sep 2023 — SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php. Se descubrió que SeaCMS V12.9 contenía una vulnerabilidad de escritura de archivos arbitraria a través del componente admin_notify.php. • https://github.com/H3ppo/vulnerabilities/blob/main/SeaCMS%20V12.9%20Arbitrary%20file%20write%20vulnerability.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-43222
https://notcve.org/view.php?id=CVE-2023-43222
26 Sep 2023 — SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file. SeaCMS v12.8 tiene una vulnerabilidad de escritura de código arbitrario en el archivo /jxz7g2/admin_ping.php. • https://blog.csdn.net/weixin_51394168/article/details/132817842 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-43278
https://notcve.org/view.php?id=CVE-2023-43278
25 Sep 2023 — A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account. Un Cross-Site Request Forgery (CSRF) en admin_manager.php de Seacms hasta v12.8 permite a los atacantes agregar arbitrariamente una cuenta de administrador. • http://seacms.com • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37124
https://notcve.org/view.php?id=CVE-2023-37124
06 Jul 2023 — A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. • https://github.com/seacms-com/seacms/issues/24 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •