SE
Product
Seacms
123
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 42High 36Medium 44Low 1
Watch
Add Seacms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-25515 | 8.8 | Feb 25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database Affected: through 13.3 |
| CVE-2024-50808 | 8.8 | Nov 8 | SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify"… Affected: 13.1 |
| CVE-2024-42599 | 8.8 | Aug 22 | SeaCMS 13.0 has a remote code execution vulnerability Affected: 13.0 |
| CVE-2024-40522 | 8.8 | Jul 12 | There is a remote code execution vulnerability in SeaCMS 12.9 Affected: 12.9 |
| CVE-2024-40521 | 8.8 | Jul 12 | SeaCMS 12.9 has a remote code execution vulnerability Affected: 12.9 |
| CVE-2024-40520 | 8.8 | Jul 12 | SeaCMS 12.9 has a remote code execution vulnerability Affected: 12.9 |
| CVE-2024-40519 | 8.8 | Jul 12 | SeaCMS 12.9 has a remote code execution vulnerability Affected: 12.9 |
| CVE-2024-40518 | 8.8 | Jul 12 | SeaCMS 12.9 has a remote code execution vulnerability Affected: 12.9 |
| CVE-2024-30565 | 8.8 | Apr 4 | An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php Affected: 12.9 |
| CVE-2023-46987 | 8.8 | Dec 28 | SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php Affected: 12.9 |
| CVE-2023-44846 | 8.8 | Oct 10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component Affected: through 12.8 |
| CVE-2023-43278 | 8.8 | Sep 25 | A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account Affected: through 12.8 |
| CVE-2019-8418 | 8.8 | Feb 17 | SeaCMS 7.2 mishandles member.php?mod=repsw4 requests Affected: 7.2 |
| CVE-2018-14910 | 8.8 | Aug 3 | SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php) Affected: 6.61 |
| CVE-2018-14421 | 8.8 | Jul 20 | SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.php) Affected: 6.61 |
| CVE-2018-13445 | 8.8 | Jul 8 | An issue was discovered in SeaCMS 6.61 Affected: 6.61 |
| CVE-2018-13444 | 8.8 | Jul 8 | An issue was discovered in SeaCMS 6.61 Affected: 6.61 |
| CVE-2019-25778 New | 8.2 | Oct 22 | SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter Affected: through 8.7 |
| CVE-2023-44848 | 8.1 | Oct 10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_template.php component Affected: through 12.8 |
| CVE-2024-44720 | 7.5 | Sep 9 | SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php Affected: 13.1 |
| CVE-2024-39027 | 7.5 | Jul 5 | SeaCMS v12.9 has an unauthorized SQL injection vulnerability Affected: 12.9 |
| CVE-2018-17365 | 7.5 | Sep 26 | SeaCMS 6.64 and 7.2 allows remote attackers to delete arbitrary files via the filedir parameter Affected: 6.64; 7.2 |
| CVE-2026-85138 | 7.3 | Sep 3 | SeaCMS WeChat index.php addslashes sql injection Affected: 13.0; 13.1; 13.2; 13.3; 13.4; 13.5; +1 more |
| CVE-2026-85137 | 7.3 | Sep 3 | SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection Affected: 13.0; 13.1; 13.2; 13.3; 13.4; 13.5; +1 more |
| CVE-2026-82600 | 7.3 | Aug 31 | SeaCMS zyapi.php sql injection Affected: 13.0; 13.1; 13.2; 13.3; 13.4; 13.5; +1 more |
| CVE-2026-82598 | 7.3 | Aug 31 | SeaCMS Template search.php parseIf code injection Affected: 13.0; 13.1; 13.2; 13.3; 13.4; 13.5; +1 more |
| CVE-2025-15003 | 7.2 | Dec 21 | SeaCMS admin_video.php sql injection Affected: 13.0; 13.1; 13.2; 13.3 |
| CVE-2025-11071 | 7.2 | Sep 27 | SeaCMS Cron Task Management admin_cron.php sql injection Affected: 13.3.20250820 |
| CVE-2025-3797 | 7.2 | Apr 19 | SeaCMS admin_topic.php sql injection Affected: through 13.3 |
| CVE-2025-3792 | 7.2 | Apr 18 | SeaCMS admin_link.php sql injection Affected: through 13.3 |
| CVE-2024-44916 | 7.2 | Aug 30 | Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and could result in… Affected: 13.1 |
| CVE-2023-44847 | 7.2 | Oct 10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component Affected: through 12.8 |
| CVE-2022-48093 | 7.2 | Feb 1 | Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php Affected: 12.7 |
| CVE-2022-28076 | 7.2 | May 4 | Seacms v11.6 was discovered to contain a remote command execution (RCE) vulnerability via the Mail Server Settings Affected: 11.6 |
| CVE-2018-19349 | 7.2 | Nov 17 | In SeaCMS v6.64, there is SQL injection via the admin_makehtml.php topic parameter because of mishandling in include/mkhtml.func.php Affected: 6.64 |
| CVE-2018-16343 | 7.2 | Sep 2 | SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS Affected: 6.61 |
Showing 36