CVE-2024-44916
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
A vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters written to the data/admin/ip.php file, potentially leading to arbitrary command execution.
Risk Assessment
The risk for the organization is the possibility of remote code execution by an attacker, which could lead to server compromise and data confidentiality breach.
Recommendation
It is recommended to immediately update Seacms to the latest version and restrict access to the admin panel to trusted IP addresses only.
Other vulnerabilities in Seacms
See all- CVE-2017-17561High
SeaCMS version 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.
- CVE-2024-54879Critical
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.
- CVE-2023-46010Critical
An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.
- CVE-2025-50592Medium
A Cross-Site Scripting (XSS) vulnerability was found in SeaCMS before version 13.2 via the 'vid' parameter in Upload/js/player/dmplayer/player. It allows a remote attacker to inject malicious JavaScript code into the page.
- CVE-2025-25813Medium
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 in the admin_files.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
- CVE-2025-25802Medium
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_ip.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
- CVE-2025-25800Medium
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.
- CVE-2025-25799Medium
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.
- CVE-2025-25797Medium
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_smtp.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
- CVE-2025-25796Medium
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_template.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
Original NVD description (English source)
Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and could result in arbitrary command execution.