SeaCMS vulnerabilities

A vulnerability was detected in SeaCMS up to 13.6. The function addslashes in the file weixin/index.php of the WeChat Module is affected. Manipulation of the argument Content results in SQL injection, which can be launched remotely.

SeaCMS version 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.

SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.

An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.

An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request.

A security vulnerability has been detected in SeaCMS up to 13.6. The function parseIf in the file seacms_locoy_news.php of the Locoy Collector component is affected. Manipulation of the argument pwd leads to code injection, and the attack can be initiated remotely.

SeaCMS up to 13.6 is vulnerable to path traversal in /member.php?action=del_pl (Comment Cache component). Manipulation of itype/vid arguments allows remote attack. Exploit is public.

SeaCMS up to 13.6 has an authorization bypass vulnerability in /ass.php. The attack can be launched remotely. The exploit has been publicly disclosed.

SeaCMS up to 13.6 is vulnerable to cross-site scripting (XSS) in /err.php. Manipulation of the errtxt argument allows remote attack. Exploit is publicly available.

A vulnerability in SeaCMS up to 13.6 in the file /zyapi.php?ac=videolist allows SQL injection through the ids argument. The attack can be initiated remotely, and the exploit is public.

SeaCMS up to 13.6 is vulnerable to path traversal in the unlink function in /member.php?action=chgpwdsubmit (Avatar Upload component). Manipulation of the oldpic argument allows remote attack. Exploit is publicly available.

A vulnerability in SeaCMS up to 13.6 in the parseIf function of the search.php file in the Template Engine component allows code injection through the searchtype argument. The attack can be initiated remotely, and the exploit is public.

A Cross-Site Scripting (XSS) vulnerability was found in SeaCMS before version 13.2 via the 'vid' parameter in Upload/js/player/dmplayer/player. It allows a remote attacker to inject malicious JavaScript code into the page.

A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 in the admin_files.php component. Attackers can exploit this flaw to execute arbitrary code on the server.

A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_ip.php component. Attackers can exploit this flaw to execute arbitrary code on the server.

SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.

SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.

A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_smtp.php component. Attackers can exploit this flaw to execute arbitrary code on the server.

A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_template.php component. Attackers can exploit this flaw to execute arbitrary code on the server.

A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 within the admin_ping.php component. Attackers can exploit this flaw to execute arbitrary code on the server.

A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 in the admin_notify.php component. An attacker can exploit this flaw to execute arbitrary code on the server.

A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 via the isopen parameter in admin_weixin.php. An attacker can send a crafted HTTP request to execute arbitrary code on the server.

SeaCms 13.1 is vulnerable to code injection in the notification module for backend users. The issue stems from unsafe handling of the 'notify' variable in admin_notify.php.

A vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters written to the data/admin/ip.php file, potentially leading to arbitrary command execution.

A cross-site scripting (XSS) vulnerability exists in the admin_ Video.php component of SeaCMS v12.8. It allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability in the /augap/adminip.php component. An attacker can exploit this flaw to execute arbitrary code on the server.

A CSRF vulnerability in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account without authorization.

A stored cross-site scripting (XSS) vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.