SE
Product
Seacms
123
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 42High 36Medium 44Low 1
Watch
Add Seacms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-4256 | 5.4 | May 5 | SeaCMS admin_paylog.php cross site scripting Affected: 13.2 |
| CVE-2024-44919 | 5.4 | Aug 29 | A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… Affected: 12.9 |
| CVE-2024-7162 | 5.4 | Jul 28 | A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0 Affected: 12.9; 13.0 |
| CVE-2023-50470 | 5.4 | Dec 28 | A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload Affected: 12.8 |
| CVE-2023-37125 | 5.4 | Jul 6 | A stored cross-site scripting (XSS) vulnerability in the Management Custom label module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted… Affected: 12.1 |
| CVE-2023-37124 | 5.4 | Jul 6 | A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload Affected: 12.1 |
| CVE-2018-19350 | 5.4 | Nov 17 | In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element Affected: 6.64 |
| CVE-2026-82602 | 5.3 | Aug 31 | SeaCMS ass.php authorization Affected: 13.0; 13.1; 13.2; 13.3; 13.4; 13.5; +1 more |
| CVE-2025-25800 | 5.3 | Feb 26 | SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php Affected: 13.3 |
| CVE-2018-16821 | 5.3 | Sep 21 | SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admin_template.php?path=../templets/../../ requests Affected: 6.64 |
| CVE-2025-25797 | 5.1 | Feb 26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php Affected: 13.3 |
| CVE-2025-25796 | 5.1 | Feb 26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php Affected: 13.3 |
| CVE-2025-25793 | 5.1 | Feb 26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php Affected: 13.3 |
| CVE-2025-25794 | 5.1 | Feb 26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php Affected: 13.3 |
| CVE-2025-25813 | 5.1 | Feb 26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php Affected: 13.3 |
| CVE-2025-25802 | 5.1 | Feb 26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php Affected: 13.3 |
| CVE-2025-60449 | 4.9 | Oct 3 | An information disclosure vulnerability has been discovered in SeaCMS 13.1 Affected: 13.1 |
| CVE-2018-16348 | 4.8 | Sep 2 | SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name Affected: 6.61 |
| CVE-2018-12431 | 4.8 | Jun 14 | SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page) Affected: 6.61 |
| CVE-2025-25792 | 4.4 | Feb 26 | SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php Affected: 13.3 |
| CVE-2026-82601 | 4.3 | Aug 31 | SeaCMS err.php cross site scripting Affected: 13.0; 13.1; 13.2; 13.3; 13.4; 13.5; +1 more |
| CVE-2025-6864 | 4.3 | Jun 29 | SeaCMS admin_type.php cross-site request forgery Affected: through 13.2 |
| CVE-2024-44918 | 3.5 | Aug 30 | A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload Affected: 12.9 |