CVE-2025-11071
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A SQL injection vulnerability was detected in SeaCMS 13.3.20250820 in an unknown function of /admin_cron.php within the Cron Task Management Module. Manipulation of the resourcefrom/collectID arguments leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
Potential unauthorized SQL query execution, data leakage or modification, and possible application compromise. The public exploit increases the likelihood of rapid exploitation.
Recommendation
Update SeaCMS to a patched version or restrict access to /admin_cron.php. Enforce input validation and parameterized SQL queries, and monitor logs for injection attempts.
Other vulnerabilities in SeaCMS
See all- CVE-2026-85138High
A vulnerability was detected in SeaCMS up to 13.6. The function addslashes in the file weixin/index.php of the WeChat Module is affected. Manipulation of the argument Content results in SQL injection, which can be launched remotely.
- CVE-2017-17561High
SeaCMS version 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.
- CVE-2024-54879Critical
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.
- CVE-2023-46010Critical
An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.
- CVE-2019-25778High
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages.
- CVE-2026-79423High
An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request.
- CVE-2026-85137High
A security vulnerability has been detected in SeaCMS up to 13.6. The function parseIf in the file seacms_locoy_news.php of the Locoy Collector component is affected. Manipulation of the argument pwd leads to code injection, and the attack can be initiated remotely.
- CVE-2026-82603Medium
SeaCMS up to 13.6 is vulnerable to path traversal in /member.php?action=del_pl (Comment Cache component). Manipulation of itype/vid arguments allows remote attack. Exploit is public.
- CVE-2026-82602Medium
SeaCMS up to 13.6 has an authorization bypass vulnerability in /ass.php. The attack can be launched remotely. The exploit has been publicly disclosed.
- CVE-2026-82601Medium
SeaCMS up to 13.6 is vulnerable to cross-site scripting (XSS) in /err.php. Manipulation of the errtxt argument allows remote attack. Exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Management Module. The manipulation of the argument resourcefrom/collectID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS