seacms vulnerabilities

Recent CVEs affecting seacms products. 59 tracked.

seacms has 59 tracked vulnerabilities, 18 critical. A fixed release or vendor patch exists for 17. Most recent: 2026-01-25. Highest priority: CVE-2024-55461 (score 61/100).

• CVE-2025-15003 MEDIUM 4.7 UPGRADE A vulnerability was found in SeaCMS up to 13.3
• CVE-2025-10662 MEDIUM 4.7 UPGRADE A vulnerability has been found in SeaCMS up to 13.3
• CVE-2025-11071 MEDIUM 4.7 DOWNGRADE A security vulnerability has been detected in SeaCMS 13.3.20250820
• CVE-2025-50592 MEDIUM 5.4 UPGRADE Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/pl
• CVE-2025-25813 MEDIUM 5.1 DOWNGRADE SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_fil
• CVE-2025-25802 MEDIUM 5.1 DOWNGRADE SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.
• CVE-2025-25800 MEDIUM 5.3 DOWNGRADE SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function a
• CVE-2025-25799 MEDIUM 6.0 DOWNGRADE SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function a
• CVE-2025-25797 MEDIUM 5.1 DOWNGRADE SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smt
• CVE-2025-25796 MEDIUM 5.1 DOWNGRADE SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_tem
• CVE-2025-25794 MEDIUM 5.1 DOWNGRADE SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_pin
• CVE-2025-25793 MEDIUM 5.1 DOWNGRADE SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_not
• CVE-2025-25792 MEDIUM 4.4 DOWNGRADE SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at
• CVE-2024-54879 CRITICAL 9.1 DOWNGRADE SeaCMS V13.1 is vulnerable to Incorrect Access Control
• CVE-2024-50808 HIGH 8.8 DOWNGRADE SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification modu
• CVE-2024-44916 HIGH 7.2 DOWNGRADE Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that
• CVE-2025-6864 MEDIUM 4.3 UPGRADE A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2
• CVE-2025-60449 MEDIUM 4.9 DOWNGRADE An information disclosure vulnerability has been discovered in SeaCMS 13.1
• CVE-2025-44073 CRITICAL 9.8 DOWNGRADE SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.
• CVE-2025-3797 MEDIUM 4.7 UPGRADE A vulnerability classified as critical was found in SeaCMS up to 13.3
• CVE-2025-3792 MEDIUM 4.7 UPGRADE A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3
• CVE-2025-29647 CRITICAL 9.8 DOWNGRADE SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
• CVE-2025-25521 CRITICAL 9.8 UPGRADE Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.
• CVE-2025-25520 CRITICAL 9.8 UPGRADE Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.
• CVE-2025-25519 CRITICAL 9.8 UPGRADE Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.
• CVE-2025-25517 CRITICAL 9.8 UPGRADE Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.
• CVE-2025-25516 CRITICAL 9.8 UPGRADE Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.
• CVE-2025-25515 HIGH 8.8 UPGRADE Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exp
• CVE-2025-25514 MEDIUM 6.5 UPGRADE Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.
• CVE-2025-25513 CRITICAL 9.8 UPGRADE Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.
• CVE-2025-22974 CRITICAL 9.8 UPGRADE SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via
• CVE-2024-7163 LOW 3.5 DOWNGRADE A vulnerability, which was classified as problematic, was found in SeaCMS 12.9
• CVE-2024-7162 LOW 3.5 DOWNGRADE A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0
• CVE-2024-7161 MEDIUM 4.3 DOWNGRADE A vulnerability classified as problematic was found in SeaCMS 13.0
• CVE-2024-6416 MEDIUM 6.3 DOWNGRADE A vulnerability was found in SeaCMS 12.9
• CVE-2024-55461 CRITICAL 9.8 UPGRADE SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().
• CVE-2024-54880 CRITICAL 9.1 DOWNGRADE SeaCMS V13.1 is vulnerable to Incorrect Access Control
• CVE-2024-46640 CRITICAL 9.8 DOWNGRADE SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp
• CVE-2024-44921 CRITICAL 9.8 DOWNGRADE SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/in
• CVE-2024-44920 MEDIUM 6.1 DOWNGRADE A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows atta
• CVE-2024-44919 MEDIUM 5.4 DOWNGRADE A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to
• CVE-2024-44918 LOW 3.5 DOWNGRADE A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attack
• CVE-2024-44721 CRITICAL 9.8 DOWNGRADE SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php
• CVE-2024-44720 HIGH 7.5 DOWNGRADE SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.
• CVE-2024-44683 MEDIUM 6.1 DOWNGRADE Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php.
• CVE-2024-42599 HIGH 8.8 DOWNGRADE SeaCMS 13.0 has a remote code execution vulnerability
• CVE-2024-42598 MEDIUM 6.7 DOWNGRADE SeaCMS 13.0 has a remote code execution vulnerability
• CVE-2024-41444 CRITICAL 9.8 DOWNGRADE SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=s
• CVE-2024-40570 MEDIUM 6.5 DOWNGRADE SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the
• CVE-2024-40522 HIGH 8.8 DOWNGRADE There is a remote code execution vulnerability in SeaCMS 12.9
• CVE-2024-40521 HIGH 8.8 DOWNGRADE SeaCMS 12.9 has a remote code execution vulnerability
• CVE-2024-40520 HIGH 8.8 DOWNGRADE SeaCMS 12.9 has a remote code execution vulnerability
• CVE-2024-40519 HIGH 8.8 DOWNGRADE SeaCMS 12.9 has a remote code execution vulnerability
• CVE-2024-40518 HIGH 8.8 DOWNGRADE SeaCMS 12.9 has a remote code execution vulnerability
• CVE-2024-39036 MEDIUM 6.5 DOWNGRADE SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin_safe.php.
• CVE-2024-39028 CRITICAL 9.8 UPGRADE An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_pin
• CVE-2024-39027 HIGH 7.5 DOWNGRADE SeaCMS v12.9 has an unauthorized SQL injection vulnerability
• CVE-2024-31611 CRITICAL 9.1 DOWNGRADE SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.
• CVE-2020-36932 MEDIUM 6.1 DOWNGRADE SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin setti

FAQ

How do I fix seacms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is seacms being exploited right now?

None of the tracked seacms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which seacms CVE should I patch first?

CVE-2024-55461 currently ranks highest (61/100): SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext()..

Products

• seacms

RSS feed for seacms · ← Back to latest CVEs