CVE-2026-82602
MediumCVSS 5.3Summary
SeaCMS up to 13.6 has an authorization bypass vulnerability in /ass.php. The attack can be launched remotely. The exploit has been publicly disclosed.
Risk Assessment
Authorization bypass may allow an attacker to perform unauthorized operations, potentially leading to data integrity compromise or system takeover.
Recommendation
Update SeaCMS to the latest version and monitor logs for suspicious requests to /ass.php.
Other vulnerabilities in SeaCMS
See all- CVE-2026-82603Medium
SeaCMS up to 13.6 is vulnerable to path traversal in /member.php?action=del_pl (Comment Cache component). Manipulation of itype/vid arguments allows remote attack. Exploit is public.
- CVE-2026-82601Medium
SeaCMS up to 13.6 is vulnerable to cross-site scripting (XSS) in /err.php. Manipulation of the errtxt argument allows remote attack. Exploit is publicly available.
- CVE-2026-82600High
A vulnerability in SeaCMS up to 13.6 in the file /zyapi.php?ac=videolist allows SQL injection through the ids argument. The attack can be initiated remotely, and the exploit is public.
- CVE-2026-82599Medium
SeaCMS up to 13.6 is vulnerable to path traversal in the unlink function in /member.php?action=chgpwdsubmit (Avatar Upload component). Manipulation of the oldpic argument allows remote attack. Exploit is publicly available.
- CVE-2026-82598High
A vulnerability in SeaCMS up to 13.6 in the parseIf function of the search.php file in the Template Engine component allows code injection through the searchtype argument. The attack can be initiated remotely, and the exploit is public.
- CVE-2017-17561High
SeaCMS version 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.
- CVE-2024-54879Critical
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.
- CVE-2023-46010Critical
An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.
- CVE-2025-50592Medium
A Cross-Site Scripting (XSS) vulnerability was found in SeaCMS before version 13.2 via the 'vid' parameter in Upload/js/player/dmplayer/player. It allows a remote attacker to inject malicious JavaScript code into the page.
- CVE-2025-25813Medium
A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 in the admin_files.php component. Attackers can exploit this flaw to execute arbitrary code on the server.
Original NVD description (English source)
A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.