Threats affecting pkg:github/nn0nkey/SeaCMS

8 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.3	EPSS 0.3%	CVE-2025-6864SeaCMS · Cross-Site Request Forgery Medium5.3EPSS 0.3%2025-06-29CVE Database V5CVE-2025-6864 A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2. Affected by this issue is some unknown functionality of the file /admin_type.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. EPSS 0.3%Vulnerability	CVE Database V5	2025-06-29
Critical	9.8	EPSS 0.6%	CVE-2024-44921SeaCMS · SQL Injection Critical9.8EPSS 0.6%2024-09-03CVE Database V5CVE-2024-44921 SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del. EPSS 0.6%Vulnerability CWE-89	CVE Database V5	2024-09-03
Medium	6.1	EPSS 0.4%	CVE-2024-44920SeaCMS · A Cross-site Scripting (XSS) Medium6.1EPSS 0.4%2024-09-03CVE Database V5CVE-2024-44920 A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the siteurl parameter. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-09-03
Low	3.5	EPSS 0.3%	CVE-2024-44918SeaCMS · A Cross-site Scripting (XSS) Low3.5EPSS 0.3%2024-08-30CVE Database V5CVE-2024-44918 A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2024-08-30
High	7.2	EPSS 1.2%	CVE-2024-44916seacms · Command Injection High7.2EPSS 1.2%2024-08-30CVE Database V5CVE-2024-44916 Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin/ip.php file and could result in arbitrary command execution. EPSS 1.2%Vulnerability CWE-77	CVE Database V5	2024-08-30
Medium	5.4	EPSS 0.4%	CVE-2024-44919SeaCMS · A Cross-site Scripting (XSS) Medium5.4EPSS 0.4%2024-08-29CVE Database V5CVE-2024-44919 A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ad description parameter. EPSS 0.4%Vulnerability CWE-79	CVE Database V5	2024-08-29
Critical	9.8	EPSS 1.1%	CVE-2024-39028SeaCMS · Command Injection Critical9.8EPSS 1.1%2024-07-05CVE Database V5CVE-2024-39028 An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php. EPSS 1.1%Vulnerability CWE-77	CVE Database V5	2024-07-05
High	8.8	EPSS 1.6%	CVE-2024-30565SeaCMS · Code Injection High8.8EPSS 1.6%2024-04-04CVE Database V5CVE-2024-30565 An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php. EPSS 1.6%Vulnerability CWE-94	CVE Database V5	2024-04-04

Page 1 of 1