Seacms vulnerabilities
Published CVEs affecting Seacms products: 3 record(s), with severity, exploitation and fixes.
CVE-2020-36932
Medium · 6.1
CWE-79 Jan 25, 2026
Seacms 11.1 - 'checkuser' Stored XSS
SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded.
CVE-2025-15003
High · 7.2
CWE-74 Dec 21, 2025
SeaCMS admin_video.php sql injection
A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argument e_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.
CVE-2025-15002
Critical · 9.8
CWE-74 Dec 21, 2025
SeaCMS mysqli.class.php sql injection
A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Such manipulation of the argument page/limit leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.