PatchTheCVE: seacms

CVE-2020-36932: SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin setti

Wed, 17 Jun 2026 03:16:32 +0000

MEDIUM 6.1: SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded.

CVE-2025-15003: A vulnerability was found in SeaCMS up to 13.3

Mon, 19 Oct 2026 22:10:00 +0000

MEDIUM 4.7: A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argument e_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

CVE-2025-60449: An information disclosure vulnerability has been discovered in SeaCMS 13.1

Wed, 17 Jun 2026 09:49:45 +0000

MEDIUM 4.9: An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentia

CVE-2025-11071: A security vulnerability has been detected in SeaCMS 13.3.20250820

Mon, 19 Oct 2026 16:10:00 +0000

MEDIUM 4.7: A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The attack can be initiated remotely. The expl

CVE-2025-10662: A vulnerability has been found in SeaCMS up to 13.3

Mon, 19 Oct 2026 17:10:00 +0000

MEDIUM 4.7: A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-50592: Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/pl

Sun, 05 Jul 2026 01:21:51 +0000

MEDIUM 5.4: Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.

CVE-2025-6864: A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2

Wed, 17 Jun 2026 10:02:43 +0000

MEDIUM 4.3: A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2. Affected by this issue is some unknown functionality of the file /admin_type.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to th

CVE-2024-40570: SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the

Wed, 17 Jun 2026 07:46:06 +0000

MEDIUM 6.5: SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component.

CVE-2025-44073: SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.

Wed, 17 Jun 2026 09:24:57 +0000

CRITICAL 9.8: SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.

CVE-2025-3797: A vulnerability classified as critical was found in SeaCMS up to 13.3

Wed, 17 Jun 2026 09:20:41 +0000

MEDIUM 4.7: A vulnerability classified as critical was found in SeaCMS up to 13.3. This vulnerability affects unknown code of the file /admin_topic.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public

CVE-2025-3792: A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3

Wed, 17 Jun 2026 09:20:40 +0000

MEDIUM 4.7: A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack may be initiated remotely. The exploit has been discl

CVE-2025-29647: SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.

Wed, 17 Jun 2026 09:05:34 +0000

CRITICAL 9.8: SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.

CVE-2025-25813: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_fil

Sun, 05 Jul 2026 01:21:34 +0000

MEDIUM 5.1: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.

CVE-2025-25802: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.

Sun, 05 Jul 2026 01:21:33 +0000

MEDIUM 5.1: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.

CVE-2025-25800: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function a

Sun, 05 Jul 2026 01:21:33 +0000

MEDIUM 5.3: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.

CVE-2025-25799: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function a

Sun, 05 Jul 2026 01:21:32 +0000

MEDIUM 6.0: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.

CVE-2025-25797: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smt

Sun, 05 Jul 2026 01:21:32 +0000

MEDIUM 5.1: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.

CVE-2025-25796: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_tem

Sun, 05 Jul 2026 01:21:31 +0000

MEDIUM 5.1: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.

CVE-2025-25794: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_pin

Sun, 05 Jul 2026 01:21:31 +0000

MEDIUM 5.1: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.

CVE-2025-25793: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_not

Sun, 05 Jul 2026 01:21:30 +0000

MEDIUM 5.1: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.

CVE-2025-25792: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at

Sun, 05 Jul 2026 01:21:30 +0000

MEDIUM 4.4: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.

CVE-2025-25521: Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.

Wed, 17 Jun 2026 09:00:52 +0000

CRITICAL 9.8: Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.

CVE-2025-25520: Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.

Wed, 17 Jun 2026 09:00:52 +0000

CRITICAL 9.8: Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.

CVE-2025-25519: Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.