Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
126 results · page 1 of 3
Oct 22, 2026SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through CVE-2019-25778 · Other software · SeaCMS · reported by VulnCheckHigh 8.8
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- SeaCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crCVE-2026-79423 · Other software · reported by MITREHigh 8.8
An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026A vulnerability was detected in SeaCMS up to 13.6.CVE-2026-85138 · Other software · reported by VulDBMedium 5.5
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026A security vulnerability has been detected in SeaCMS up to 13.6.CVE-2026-85137 · Other software · reported by VulDBMedium 5.5
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A vulnerability was detected in SeaCMS up to 13.6.CVE-2026-82603 · Other software · reported by VulDBLow 2.1
A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A security vulnerability has been detected in SeaCMS up to 13.6.CVE-2026-82602 · Other software · reported by VulDBMedium 5.5
A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A weakness has been identified in SeaCMS up to 13.6.CVE-2026-82601 · Other software · reported by VulDBLow 2.1
A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A security flaw has been discovered in SeaCMS up to 13.6.CVE-2026-82600 · Other software · reported by VulDBMedium 5.5
A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A vulnerability was identified in SeaCMS up to 13.6.CVE-2026-82599 · Other software · reported by VulDBLow 2.1
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2026A vulnerability was determined in SeaCMS up to 13.6.CVE-2026-82598 · Other software · reported by VulDBMedium 5.5
A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2026SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page.CVE-2020-36932 · Other software · Seacms · reported by VulnCheckMedium 5.1
SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comseacms.net
Dec 21, 2025A vulnerability was found in SeaCMS up to 13.3.CVE-2025-15003 · Other software · Seacms · reported by VulDBLow 2
A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argument e_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Dec 21, 2025A vulnerability has been found in SeaCMS up to 13.3.CVE-2025-15002 · Other software · Seacms · reported by VulDBMedium 5.5
A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Such manipulation of the argument page/limit leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnote-hxlab.wetolink.comvuldb.com
Oct 3, 2025An information disclosure vulnerability has been discovered in SeaCMS 13.1.CVE-2025-60449 · Other software · Seacms · reported by MITREMedium 4.9
An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentially any file accessible on the server’s root directory.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2025A security vulnerability has been detected in SeaCMS 13.3.20250820.CVE-2025-11071 · Other software · Seacms · reported by VulDBLow 2
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025A vulnerability has been found in SeaCMS up to 13.3.CVE-2025-10662 · Other software · Seacms · reported by VulDBLow 2
A vulnerability has been found in SeaCMS up to 13.3. The impacted element is an unknown function of the file /admin_members.php?ac=editsave. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This affects another injection point than CVE-2025-25513.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.CVE-2025-50592 · Other software · Seacms · reported by MITREMedium 5.4
Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2025A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2.CVE-2025-6864 · Other software · Seacms · reported by VulDBLow 2.1
A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2. Affected by this issue is some unknown functionality of the file /admin_type.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2025SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component.CVE-2024-40570 · Other software · Seacms · reported by MITREMedium 6.5
SQL Injection vulnerability in SeaCMS v.12.9 allows a remote attacker to obtain sensitive information via the admin_datarelate.php component.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 6, 2025SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.CVE-2025-44073 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.CVE-2025-44074 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.CVE-2025-44072 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php.CVE-2025-44071 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execute arbitrary code via a crafted request.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2.CVE-2025-4257 · Other software · Seacms · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file /admin_pay.php. The manipulation of the argument cstatus leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2025A vulnerability classified as problematic was found in SeaCMS 13.2.CVE-2025-4256 · Other software · Seacms · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in SeaCMS 13.2. This vulnerability affects unknown code of the file /admin_paylog.php. The manipulation of the argument cstatus leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2025A vulnerability classified as critical was found in SeaCMS up to 13.3.CVE-2025-3797 · Other software · Seacms · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in SeaCMS up to 13.3. This vulnerability affects unknown code of the file /admin_topic.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3.CVE-2025-3792 · Other software · Seacms · reported by VulDBMedium 5.1
A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.CVE-2025-29647 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.CVE-2025-25813 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.CVE-2025-25802 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.CVE-2025-25800 · Other software · Seacms · reported by MITREMedium 5.3
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.CVE-2025-25799 · Other software · Seacms · reported by MITREMedium 6
SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.CVE-2025-25797 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.CVE-2025-25796 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.CVE-2025-25794 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.CVE-2025-25793 · Other software · Seacms · reported by MITREMedium 5.1
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.CVE-2025-25792 · Other software · Seacms · reported by MITREMedium 4.4
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.CVE-2025-25521 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.CVE-2025-25520 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.CVE-2025-25519 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.CVE-2025-25517 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.CVE-2025-25516 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.CVE-2025-25515 · Other software · Seacms · reported by MITREHigh 8.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.CVE-2025-25514 · Other software · Seacms · reported by MITREMedium 6.5
Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php compCVE-2025-22974 · Other software · Seacms · reported by MITRECritical 9.8
SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php component.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.CVE-2025-25513 · Other software · Seacms · reported by MITRECritical 9.8
Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025SeaCMS V13.1 is vulnerable to Incorrect Access Control.CVE-2024-54880 · Other software · Seacms · reported by MITRECritical 9.1
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.csdn.netseacms.net
Jan 6, 2025SeaCMS V13.1 is vulnerable to Incorrect Access Control.CVE-2024-54879 · Other software · Seacms · reported by MITRECritical 9.1
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().CVE-2024-55461 · Other software · Seacms · reported by MITRECritical 9.8
SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().
- Product
- Seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2024SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handlCVE-2024-50808 · Other software · seacms · reported by MITREHigh 8.8
SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in admin_notify.php.
- Product
- seacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.