SeaCMS vulnerabilities
We track 25 vulnerabilities in SeaCMS products. 25 are rated high or critical, and none are known to be exploited. The most recent was published on September 3, 2026.
Latest SeaCMS vulnerabilities
- 7.3 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The expl
- 7.3 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated rem
- 7.3 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. Th
- 7.3 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. T
- 7.2 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argument e_id results in sql injection. The attack is possible to be carried out remotely. The exploit has
- 9.8 Critical severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Such manipulation of the argument page/limit leads to sql injection. The attack can be executed remotel
- 7.2 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The at
- 9.8 Critical severity
SeaCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been
- 9.8 Critical severity
Seacms: Improper Control of Generation of Code
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execute arbitrary code via a crafted request.
- 7.2 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in SeaCMS up to 13.3. This vulnerability affects unknown code of the file /admin_topic.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack can be initiated remotely. The e
- 7.2 High severity
SeaCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack may be initia
- 9.8 Critical severity
Seacms: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php component.
- 9.1 Critical severity
Seacms: Improper Preservation of Permissions
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.
- 8.8 High severity
seacms: Improper Control of Generation of Code
SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in admin_notify.php.
- 9.8 Critical severity
seacms: Improper Control of Generation of Code
SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not executed during execution, allowing remote code execution by writing to the file through the MySQL slow
- 7.2 High severity
seacms: Improper Neutralization of Special Elements used in a Command
Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and could result in arbitrary command execution.
- 8.8 High severity
seacms: Improper Control of Generation of Code
SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to ex
- 8.8 High severity
seacms: Improper Control of Generation of Code
There is a remote code execution vulnerability in SeaCMS 12.9. The vulnerability is caused by phomebak.php writing some variable names passed in without filtering them before writing them into the php file. An authenticated attacker can exploit this vulnerabil
- 8.8 High severity
seacms: Improper Control of Generation of Code
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is due to the fact that although admin_template.php imposes certain restrictions on the edited file, attackers can still bypass the restrictions and write code in some way, allowing authe
- 8.8 High severity
SeaCMS 12.9 has a remote code execution vulnerability.
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_config_mark.php directly splicing and writing the user input data into inc_photowatermark_config.php without processing it, which allows authenticated attackers to expl
- 8.8 High severity
SeaCMS 12.9 has a remote code execution vulnerability.
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_weixin.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to
- 7.5 High severity
seacms: Improper Neutralization of Special Elements used in an SQL Command
SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked.
- 9.8 Critical severity
SeaCMS: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/dmplayer/dmku/?ac=edit. The manipulation of the argument cid with the input (select(0)from(select(slee
- 9.8 Critical severity
seacms: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php.
- 9.8 Critical severity
SeaCMS: Deserialization of Untrusted Data
A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. The attack may be laun