Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
350 results · page 2 of 7
Dec 21, 2025A vulnerability was found in SeaCMS up to 13.3.CVE-2025-15003 · Other software · Seacms · reported by VulDBLow 2
A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argument e_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Dec 21, 2025A vulnerability has been found in SeaCMS up to 13.3.CVE-2025-15002 · Other software · Seacms · reported by VulDBMedium 5.5
A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Such manipulation of the argument page/limit leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Dec 18, 2025Tina is a headless content management system.CVE-2025-68278 · Other software · tinacms · reported by GitHubHigh 7.3
Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2025-66492 · Other software · MasaCMS · reported by GitHubHigh 8.2
Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of the HTML page. An attacker can execute arbitrary scripts in the context of the user's session, potentially leading to Session Hijacking, Data Theft, Defacement and Malware Distribution. This issue is fixed in versions 7.5.2, 7.4.9, 7.3.14, and 7.2.9. To work around this issue, configure a Web Application Firewall (WAF) rule (e.g., ModSecurity) to block requests containing common XSS payload characters in the ajax query parameter. Alternatively, implement server-side sanitization using middleware to strip or escape dangerous characters from the ajax parameter before it reaches the vulnerable rendering logic.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2025A vulnerability has been found in IdeaCMS up to 1.8.CVE-2025-14245 · Other software · Ideacms · reported by VulDBMedium 5.5
A vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file app/common/logic/index/Coupon.php. Such manipulation of the argument params leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Ideacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2024-32643 · Other software · MasaCMS · reported by GitHubHigh 7.5
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2024-32642 · Other software · MasaCMS · reported by GitHubHigh 8.8
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025Masa CMS is an open source Enterprise Content Management platform.CVE-2024-32641 · Other software · MasaCMS · reported by GitHubCritical 9.8
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated by setDynamicContent, allowing an unauthenticated attacker to execute arbitrary code via the m tag. The vulnerability is patched in versions 7.2.8, 7.3.13, and 7.4.6.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2025A vulnerability was found in IdeaCMS up to 1.8.CVE-2025-11331 · Other software · Ideacms · reported by VulDBLow 2
A vulnerability was found in IdeaCMS up to 1.8. The impacted element is an unknown function of the file app/common/logic/admin/Config.php of the component Website Name Handler. Performing manipulation of the argument 网站名称 results in command injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Ideacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2025A vulnerability has been found in SeriaWei ZKEACMS up to 4.3.CVE-2025-11272 · Other software · SeriaWei · reported by VulDBLow 2.1
A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ZKEACMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2025An information disclosure vulnerability has been discovered in SeaCMS 13.1.CVE-2025-60449 · Other software · Seacms · reported by MITREMedium 4.9
An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentially any file accessible on the server’s root directory.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2025A security vulnerability has been detected in SeaCMS 13.3.20250820.CVE-2025-11071 · Other software · Seacms · reported by VulDBLow 2
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScripCVE-2025-57692 · Other software · Dotnetfoundation · reported by MITREMedium 6.8
PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.
- Product
- Piranha CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2025A weakness has been identified in SeriaWei ZKEACMS up to 4.3.CVE-2025-10766 · Other software · SeriaWei · reported by VulDBLow 2.1
A weakness has been identified in SeriaWei ZKEACMS up to 4.3. This issue affects the function Download of the file EventViewerController.cs. Executing manipulation of the argument ID can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ZKEACMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2025A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3.CVE-2025-10765 · Other software · SeriaWei · reported by VulDBLow 2
A security flaw has been discovered in SeriaWei ZKEACMS up to 4.3. This vulnerability affects the function CheckPage/Suggestions in the library cms-v4.3\wwwroot\Plugins\ZKEACMS.SEOSuggestions\ZKEACMS.SEOSuggestions.dll of the component SEOSuggestions. Performing manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ZKEACMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2025A vulnerability was identified in SeriaWei ZKEACMS up to 4.3.CVE-2025-10764 · Other software · SeriaWei · reported by VulDBLow 2.1
A vulnerability was identified in SeriaWei ZKEACMS up to 4.3. This affects the function Edit of the file src/ZKEACMS.EventAction/Controllers/PendingTaskController.cs of the component Event Action System. Such manipulation of the argument Data leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ZKEACMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025A vulnerability has been found in SeaCMS up to 13.3.CVE-2025-10662 · Other software · Seacms · reported by VulDBLow 2
A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This affects another injection point than CVE-2025-25513.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was detected in ZKEACMS 4.3.CVE-2025-10471 · Other software · Zkea · reported by VulDBLow 2.1
A vulnerability was detected in ZKEACMS 4.3. Impacted is the function Proxy of the file src/ZKEACMS/Controllers/MediaController.cs. Performing manipulation of the argument url results in server-side request forgery. It is possible to initiate the attack remotely. The exploit is now public and may be used.
- Product
- Zkeacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025MASA CMS is an Enterprise Content Management platform based on open source technology.CVE-2024-32640 · Other software · MasaCMS · reported by GitHubCritical 9.8
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5, 7.3.12, and 7.2.7 contain a fix for the issue.
- Product
- MasaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.CVE-2025-50592 · Other software · Seacms · reported by MITREMedium 5.4
Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.CVE-2025-52239 · Other software · Zkea · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file.
- Product
- Zkeacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2.CVE-2025-6864 · Other software · Seacms · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2. Affected by this issue is some unknown functionality of the file /admin_type.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component.CVE-2024-40570 · Other software · Seacms · reported by MITREMedium 6.5
SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 4, 2025A vulnerability was found in IdeaCMS up to 1.7 and classified as critical.CVE-2025-5569 · Other software · Ideacms · reported by VulDBMedium 5.3
A vulnerability was found in IdeaCMS up to 1.7 and classified as critical. This issue affects the function Article/Goods of the file /api/v1.index.article/getList.html. The manipulation of the argument Field leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.8 is able to address this issue. The patch is named 935aceb4c21338633de6d41e13332f7b9db4fa6a. It is recommended to upgrade the affected component.
- Product
- Ideacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025A vulnerability classified as problematic was found in XiaoBingby TeaCMS 2.0.2.CVE-2025-5033 · Other software · XiaoBingby · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in XiaoBingby TeaCMS 2.0.2. Affected by this vulnerability is an unknown functionality of the file src/main/java/me/teacms/controller/admin/UserManageController/addUser. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- TeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.CVE-2025-44073 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6.CVE-2025-4291 · Other software · Ideacms · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in IdeaCMS up to 1.6. Affected is the function saveUpload. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Ideacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.CVE-2025-44074 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.CVE-2025-44072 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php.CVE-2025-44071 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execute arbitrary code via a crafted request.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2.CVE-2025-4257 · Other software · Seacms · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file /admin_pay.php. The manipulation of the argument cstatus leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability classified as problematic was found in SeaCMS 13.2.CVE-2025-4256 · Other software · Seacms · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in SeaCMS 13.2. This vulnerability affects unknown code of the file /admin_paylog.php. The manipulation of the argument cstatus leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2025A vulnerability classified as critical was found in SeaCMS up to 13.3.CVE-2025-3797 · Other software · Seacms · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in SeaCMS up to 13.3. This vulnerability affects unknown code of the file /admin_topic.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3.CVE-2025-3792 · Other software · Seacms · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.CVE-2025-29647 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.CVE-2025-25813 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.CVE-2025-25802 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.CVE-2025-25800 · Other software · Seacms · reported by MITREMedium 5.3
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.CVE-2025-25799 · Other software · Seacms · reported by MITREMedium 6
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.CVE-2025-25797 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.CVE-2025-25796 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.CVE-2025-25794 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.CVE-2025-25793 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.CVE-2025-25792 · Other software · Seacms · reported by MITREMedium 4.4
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.CVE-2025-25521 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.CVE-2025-25520 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.CVE-2025-25519 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.CVE-2025-25517 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.CVE-2025-25516 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.CVE-2025-25515 · Other software · Seacms · reported by MITREHigh 8.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.