VULNERABILITY INTELLIGENCE

CVE-2018-14421

CVSS score8.8 HIGH
EPSS probability0.89%
CISA KEVNot currently listed
Published2018-07-20
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.php). The code is executed by visiting /details/index.php. This can also be exploited through CSRF.

Weakness classification

  • nvd@nist.gov: CWE-94

Primary references