Seafile records

12 published records for vendor seafile.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 16.7%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

12 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-30587No exploit	Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro,seafile · seafile server · CWE-79 XSS	High8.7	—	0.2%	Mar 25, 2026
31Monitor	CVE-2020-16143No exploit	The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory.seafile · seafile-client · CWE-427	High7.8	—	0.4%	Jul 29, 2020
31Monitor	CVE-2014-5443No exploit	Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet hseafile · seafile server · CWE-264 Local privilege escalation	High7.8	—	0.4%	Mar 19, 2018
30Monitor	CVE-2019-8919No exploit	The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipherseafile · seadroid · CWE-330 Pre-auth Weak crypto	High7.5	—	1.4%	Feb 18, 2019
30Monitor	CVE-2013-7469No exploit	Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, makingseafile · seafile · CWE-326 Pre-auth Weak crypto	High7.5	—	1.0%	Feb 20, 2019
24Monitor	CVE-2023-28874No exploit	The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.seafile · seafile · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.4%	Dec 9, 2023
24Monitor	CVE-2025-65516No exploit	A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12.seafile · seafile server · CWE-79 Pre-auth XSS	Medium6.1	—	0.2%	Dec 4, 2025
23Monitor	CVE-2021-43820No exploit	Permissions check bypass in Seafileseafile · seafile server · CWE-639 Pre-auth Broken access control (IDOR)	Medium5.9	—	0.9%	Dec 14, 2021
21Monitor	CVE-2021-30146Proof of concept	Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."seafile · seafile · CWE-79 XSS	Medium5.4	—	0.8%	Apr 6, 2021
21Monitor	CVE-2023-28873No exploit	An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.seafile · seafile · CWE-79 XSS	Medium5.4	—	0.4%	Dec 9, 2023
20Monitor	CVE-2025-41079No exploit	Multiple vulnerabilities in Seafileseafile · seafile · CWE-79 RCE XSS	Medium5.1	—	0.2%	Dec 4, 2025
20Monitor	CVE-2025-41080No exploit	Multiple vulnerabilities in Seafileseafile · seafile · CWE-79 RCE XSS	Medium5.1	—	0.2%	Dec 4, 2025

CVE-2026-30587
34Monitor
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro,
HighCVSS 8.7No exploitEPSS 0%
- XSS
seafile · seafile serverMar 25, 2026
CVE-2020-16143
31Monitor
The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory.
HighCVSS 7.8No exploitEPSS 0%
seafile · seafile-clientJul 29, 2020
CVE-2014-5443
31Monitor
Seafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet h
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
seafile · seafile serverMar 19, 2018
CVE-2019-8919
30Monitor
The seadroid (aka Seafile Android Client) application through 2.2.13 for Android always uses the same Initialization Vector (IV) with Cipher
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Weak crypto
seafile · seadroidFeb 18, 2019
CVE-2013-7469
30Monitor
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Weak crypto
seafile · seafileFeb 20, 2019
CVE-2023-28874
24Monitor
The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- Open redirect
seafile · seafileDec 9, 2023
CVE-2025-65516
24Monitor
A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
seafile · seafile serverDec 4, 2025
CVE-2021-43820
23Monitor
Permissions check bypass in Seafile
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
seafile · seafile serverDec 14, 2021
CVE-2021-30146
21Monitor
Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
MediumCVSS 5.4Proof of conceptEPSS 0%
- XSS
seafile · seafileApr 6, 2021
CVE-2023-28873
21Monitor
An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
MediumCVSS 5.4No exploitEPSS 0%
- XSS
seafile · seafileDec 9, 2023
CVE-2025-41079
20Monitor
Multiple vulnerabilities in Seafile
MediumCVSS 5.1No exploitEPSS 0%
- RCE
- XSS
seafile · seafileDec 4, 2025
CVE-2025-41080
20Monitor
Multiple vulnerabilities in Seafile
MediumCVSS 5.1No exploitEPSS 0%
- RCE
- XSS
seafile · seafileDec 4, 2025