CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37125
https://notcve.org/view.php?id=CVE-2023-37125
06 Jul 2023 — A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. • https://github.com/seacms-com/seacms/issues/25 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2926 – SeaCMS Picture Upload member.php denial of service
https://notcve.org/view.php?id=CVE-2023-2926
27 May 2023 — A vulnerability was found in SeaCMS 11.6 and classified as problematic. This issue affects some unknown processing of the file member.php of the component Picture Upload Handler. The manipulation of the argument oldpic leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://github.com/xryj920/CVE/blob/main/DEL.md • CWE-404: Improper Resource Shutdown or Release •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0960 – SeaCMS Picture Management config.ftp.php deserialization
https://notcve.org/view.php?id=CVE-2023-0960
22 Feb 2023 — A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/jidle123/Seacms-v11.6/issues/1 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-48093
https://notcve.org/view.php?id=CVE-2022-48093
01 Feb 2023 — Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php. • https://www.yuque.com/litanhua-fost9/hu05qa/ng2cb9ln0i0oqpo7?singleDo • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2021-39426
https://notcve.org/view.php?id=CVE-2021-39426
15 Dec 2022 — An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the action parameter equals set. Se descubrió un problema en /Upload/admin/admin_notify.php en Seacms 11.4 que permite a los atacantes ejecutar código php arbitrario a través del parámetro notify1 cuando el parámetro de action es igual a set. • https://github.com/seacms-com/seacms/issues/21 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-43256
https://notcve.org/view.php?id=CVE-2022-43256
16 Nov 2022 — SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php. Se descubrió que SeaCms anterior a v12.6 contenía una vulnerabilidad de inyección SQL a través del componente /js/player/dmplayer/dmku/index.php. • https://github.com/seacms-com/seacms/issues/23 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 1%CPEs: 1EXPL: 1CVE-2022-28076
https://notcve.org/view.php?id=CVE-2022-28076
04 May 2022 — Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings. Se ha detectado que Seacms versión v11.6, contiene una vulnerabilidad de ejecución de comandos remota (RCE) por medio de la configuración del servidor de correo • https://github.com/likCodinG/seacms_vul/issues/1 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-27336
https://notcve.org/view.php?id=CVE-2022-27336
27 Apr 2022 — Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php. Se ha detectado que Seacms versión v11.6, contiene una vulnerabilidad de ejecución de código remota (RCE) por medio del componente /admin/weixin.php • http://note.youdao.com/noteshare?id=1f5c9012a358f0c4575e1ca57a55fe5e&sub=6C2906C73BB0477FB9DE8601D5495C0A •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23878
https://notcve.org/view.php?id=CVE-2022-23878
02 Mar 2022 — seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php. seacms versión V11.5, está afectado por una vulnerabilidad de ejecución de código arbitrario en el archivo admin_config.php • https://blog.csdn.net/miuzzx/article/details/122249953 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-37358
https://notcve.org/view.php?id=CVE-2021-37358
18 Aug 2021 — SQL Injection in SEACMS v210530 (2021-05-30) allows remote attackers to execute arbitrary code via the component "admin_ajax.php?action=checkrepeat&v_name=". Una inyección SQL en SEACMS versión v210530 (30-05-2021) permite a atacantes remotos ejecutar código arbitrario por medio del componente "admin_ajax.php?action=checkrepeat&v_name=". • https://github.com/kk98kk0/exploit/blob/master/SEACMS-V210530-sql.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •