CVE-2018-14910

PoC —

CVSS 3.0

8.8 high

EPSS

<1%p60

Published

Aug 3, 2018 (Aug 3, 2018)

Modified

Jun 17, 2026

Description

SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php). The code is executed by visiting adm1n/admin_ip.php or data/admin/ip.php. This can also be exploited through CSRF.

Vendors: seacms
Products: seacms
Weakness: CWE-94, CWE-352
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.