Seacms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2019-25778 SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through High 8.8 · Oct 22, 2026
• CVE-2025-44073 SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.Critical 9.8 · May 6, 2025
• CVE-2025-44074 SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.Critical 9.8 · May 5, 2025
• CVE-2025-44072 SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.Critical 9.8 · May 5, 2025
• CVE-2025-44071 SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php.Critical 9.8 · May 5, 2025
• CVE-2025-29647 SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.Critical 9.8 · Apr 3, 2025
• CVE-2025-25521 Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.Critical 9.8 · Feb 25, 2025
• CVE-2025-25520 Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.Critical 9.8 · Feb 25, 2025
• CVE-2025-25519 Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.Critical 9.8 · Feb 25, 2025
• CVE-2025-25517 Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.Critical 9.8 · Feb 25, 2025
• CVE-2025-25516 Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.Critical 9.8 · Feb 25, 2025
• CVE-2025-25515 Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.High 8.8 · Feb 25, 2025
• CVE-2025-22974 SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php compCritical 9.8 · Feb 24, 2025
• CVE-2025-25513 Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.Critical 9.8 · Feb 24, 2025
• CVE-2024-54880 SeaCMS V13.1 is vulnerable to Incorrect Access Control.Critical 9.1 · Jan 6, 2025
• CVE-2024-54879 SeaCMS V13.1 is vulnerable to Incorrect Access Control.Critical 9.1 · Jan 6, 2025
• CVE-2024-55461 SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().Critical 9.8 · Dec 18, 2024
• CVE-2024-50808 SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handlHigh 8.8 · Nov 8, 2024
• CVE-2024-46640 SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp.Critical 9.8 · Sep 20, 2024
• CVE-2024-44721 SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.Critical 9.8 · Sep 9, 2024
• CVE-2024-44720 SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.High 7.5 · Sep 9, 2024
• CVE-2024-44921 SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del.Critical 9.8 · Sep 3, 2024
• CVE-2024-44916 Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and couHigh 7.2 · Aug 30, 2024
• CVE-2024-41444 SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so.Critical 9.8 · Aug 26, 2024
• CVE-2024-42599 SeaCMS 13.0 has a remote code execution vulnerability.High 8.8 · Aug 22, 2024