CVE-2020-36932 | Medium | 6.1 | 2026-01-25 | SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScri… |
CVE-2025-15003 | Medium | 4.7 | 2025-12-22 | A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argum… |
CVE-2025-15002 | High | 7.3 | 2025-12-21 | A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Su… |
CVE-2025-60449 | Medium | 4.9 | 2025-10-03 | An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ di… |
CVE-2025-11071 | Medium | 4.7 | 2025-09-27 | A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Mana… |
CVE-2025-10662 | Medium | 4.7 | 2025-09-18 | A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation… |
CVE-2025-50592 | Medium | 5.4 | 2025-08-05 | Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player. |
CVE-2025-6864 | Medium | 4.3 | 2025-06-29 | A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2. Affected by this issue is some unknown functionality of the file /ad… |
CVE-2024-40570 | Medium | 6.5 | 2025-06-17 | SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component. |
CVE-2025-44073 | Critical | 9.8 | 2025-05-06 | SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php. |
CVE-2025-44074 | Critical | 9.8 | 2025-05-05 | SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php. |
CVE-2025-44072 | Critical | 9.8 | 2025-05-05 | SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php. |
CVE-2025-44071 | Critical | 9.8 | 2025-05-05 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execu… |
CVE-2025-4257 | Low | 3.5 | 2025-05-05 | A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file /admin_pay.php. The… |
CVE-2025-4256 | Low | 3.5 | 2025-05-05 | A vulnerability classified as problematic was found in SeaCMS 13.2. This vulnerability affects unknown code of the file /admin_paylog.php. The manipulation of… |
CVE-2025-3797 | Medium | 4.7 | 2025-04-19 | A vulnerability classified as critical was found in SeaCMS up to 13.3. This vulnerability affects unknown code of the file /admin_topic.php?action=delall. The… |
CVE-2025-3792 | Medium | 4.7 | 2025-04-18 | A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?… |
CVE-2025-29647 | Critical | 9.8 | 2025-04-03 | SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php. |
CVE-2025-25813 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php. |
CVE-2025-25802 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php. |
CVE-2025-25800 | Medium | 5.3 | 2025-02-26 | SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php. |
CVE-2025-25799 | Medium | 6.0 | 2025-02-26 | SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php. |
CVE-2025-25797 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php. |
CVE-2025-25796 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php. |
CVE-2025-25794 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php. |
CVE-2025-25793 | Medium | 5.1 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php. |
CVE-2025-25792 | Medium | 4.4 | 2025-02-26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php. |
CVE-2025-25521 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php. |
CVE-2025-25520 | Critical | 9.8 | 2025-02-25 | Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php. |
CVE-2025-25519 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php. |
CVE-2025-25517 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php. |
CVE-2025-25516 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php. |
CVE-2025-25515 | High | 8.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database. |
CVE-2025-25514 | Medium | 6.5 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php. |
CVE-2025-22974 | Critical | 9.8 | 2025-02-24 | SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php com… |
CVE-2025-25513 | Critical | 9.8 | 2025-02-24 | Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php. |
CVE-2024-54880 | Critical | 9.1 | 2025-01-06 | SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk. |
CVE-2024-54879 | Critical | 9.1 | 2025-01-06 | SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely. |
CVE-2024-55461 | Critical | 9.8 | 2024-12-18 | SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext(). |
CVE-2024-50808 | High | 8.8 | 2024-11-08 | SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe hand… |
CVE-2024-46640 | Critical | 9.8 | 2024-09-20 | SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not ex… |
CVE-2024-44721 | Critical | 9.8 | 2024-09-09 | SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php. |
CVE-2024-44720 | High | 7.5 | 2024-09-09 | SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php. |
CVE-2024-44921 | Critical | 9.8 | 2024-09-03 | SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del. |
CVE-2024-44920 | Medium | 6.1 | 2024-09-03 | A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2024-44683 | Medium | 6.1 | 2024-08-30 | Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php. |
CVE-2024-44918 | Low | 3.5 | 2024-08-30 | A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2024-44916 | High | 7.2 | 2024-08-30 | Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and co… |
CVE-2024-44919 | Medium | 5.4 | 2024-08-29 | A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2024-41444 | Critical | 9.8 | 2024-08-26 | SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so. |
CVE-2024-42599 | High | 8.8 | 2024-08-22 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files… |
CVE-2024-42598 | Medium | 6.7 | 2024-08-20 | SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_editplayer.php imposes restrictions on edited f… |
CVE-2024-7163 | Low | 3.5 | 2024-07-28 | A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php… |
CVE-2024-7162 | Low | 3.5 | 2024-07-28 | A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionality of the file js/p… |
CVE-2024-7161 | Medium | 4.3 | 2024-07-28 | A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /member.php?action=c… |
CVE-2024-39036 | Medium | 6.5 | 2024-07-16 | SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php. |
CVE-2024-40522 | High | 8.8 | 2024-07-12 | There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filter… |
CVE-2024-40521 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on th… |
CVE-2024-40520 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_config_mark.php directly splicing and writing the user input data i… |
CVE-2024-40519 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_smtp.php directly splicing and writing the user input data into wei… |
CVE-2024-40518 | High | 8.8 | 2024-07-12 | SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into w… |
CVE-2024-39028 | Critical | 9.8 | 2024-07-05 | An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php. |
CVE-2024-39027 | High | 7.5 | 2024-07-05 | SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer… |
CVE-2024-6416 | Medium | 6.3 | 2024-06-30 | A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/d… |
CVE-2024-31611 | Critical | 9.1 | 2024-06-10 | SeaCMS 12.9 has a file deletion vulnerability via admin_template.php. |
CVE-2024-30565 | High | 8.8 | 2024-04-04 | An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php. |
CVE-2024-29275 | Critical | 9.8 | 2024-03-22 | SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the… |
CVE-2023-50470 | Medium | 5.4 | 2023-12-28 | A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2023-46987 | High | 8.8 | 2023-12-28 | SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php. |
CVE-2023-46010 | Critical | 9.8 | 2023-10-25 | An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component. |
CVE-2023-44848 | High | 8.1 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component. |
CVE-2023-44847 | High | 7.2 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component. |
CVE-2023-44846 | High | 8.8 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component. |
CVE-2023-44172 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php. |
CVE-2023-44171 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php. |
CVE-2023-44170 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php. |
CVE-2023-44169 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php. |
CVE-2023-43222 | Critical | 9.8 | 2023-09-27 | SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file. |
CVE-2023-43216 | Critical | 9.8 | 2023-09-27 | SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php. |
CVE-2023-43278 | High | 8.8 | 2023-09-25 | A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account. |
CVE-2023-37125 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HT… |
CVE-2023-37124 | Medium | 5.4 | 2023-07-06 | A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a craf… |
CVE-2023-2926 | Medium | 5.4 | 2023-05-27 | A vulnerability was found in SeaCMS 11.6 and classified as problematic. This issue affects some unknown processing of the file member.php of the component Pict… |
CVE-2023-0960 | Medium | 4.7 | 2023-02-22 | A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php o… |
CVE-2022-48093 | High | 7.2 | 2023-02-01 | Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php. |
CVE-2021-39426 | Critical | 9.8 | 2022-12-15 | An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the acti… |
CVE-2022-43256 | Critical | 9.8 | 2022-11-16 | SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php. |
CVE-2022-28076 | High | 7.2 | 2022-05-04 | Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings. |
CVE-2022-27336 | Critical | 9.8 | 2022-04-27 | Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php. |
CVE-2022-23878 | Critical | 9.8 | 2022-03-02 | seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php. |
CVE-2021-37358 | Critical | 9.8 | 2021-08-18 | SQL Injection in SEACMS v210530 (2021-05-30) allows remote attackers to execute arbitrary code via the component "admin_ajax.php?action=checkrepeat&v_name=". |
CVE-2021-29313 | Medium | 6.1 | 2021-08-17 | Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php, |
CVE-2020-28846 | Medium | 6.5 | 2021-08-17 | Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin account. |
CVE-2020-26642 | Medium | 6.1 | 2021-05-28 | A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an attacker to inject arbitrary web script o… |
CVE-2020-21378 | Critical | 9.8 | 2020-12-21 | SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.php. |
CVE-2019-8418 | High | 8.8 | 2019-02-17 | SeaCMS 7.2 mishandles member.php?mod=repsw4 requests. |
CVE-2018-19350 | Medium | 5.4 | 2018-11-17 | In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJ… |
CVE-2018-19349 | High | 7.2 | 2018-11-17 | In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php. |
CVE-2018-17365 | High | 7.5 | 2018-09-26 | SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter. |
CVE-2018-17321 | Medium | 6.1 | 2018-09-22 | An issue was discovered in SeaCMS 6.64. XSS exists in admin_datarelate.php via the time or maxHit parameter in a dorandomset action. |