Skip to content
Noroxi

seeddms records

33 published records for vendor seeddms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

33 records
  • CVE-2022-44938
    39Monitor

    Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack.

    CriticalCVSS 9.8No exploitEPSS 1%

    seeddms · seeddmsDec 8, 2022

  • CVE-2018-12941
    36Monitor

    This vulnerability allows remote attackers to execute arbitrary code in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 by adding a system

    HighCVSS 8.8No exploitEPSS 3%

    seeddms · seeddmsJul 31, 2018

  • CVE-2018-12940
    36Monitor

    Unrestricted file upload vulnerability in "op/op.UploadChunks.php" in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attack

    HighCVSS 8.8No exploitEPSS 2%

    seeddms · seeddmsJul 31, 2018

  • CVE-2018-12942
    35Monitor

    SQL injection vulnerability in the "Users management" functionality in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows authenticate

    HighCVSS 8.8No exploitEPSS 1%

    seeddms · seeddmsJul 31, 2018

  • CVE-2021-33223
    35Monitor

    An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php fil

    HighCVSS 8.8No exploitEPSS 0%

    seeddms · seeddmsJun 6, 2023

  • CVE-2019-12744
    33Monitor

    SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability tha

    HighCVSS 7.5Proof of conceptEPSS 11%

    seeddms · seeddmsJun 20, 2019

  • CVE-2025-45752
    28Monitor

    A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functi

    HighCVSS 7.2No exploitEPSS 0%

    seeddms · seeddmsMay 21, 2025

  • CVE-2014-2279
    27Monitor

    Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with

    MediumCVSS 6.4No exploitEPSS 5%

    seeddms · seeddmsOct 17, 2014

  • CVE-2018-12939
    27Monitor

    A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially

    MediumCVSS 6.5No exploitEPSS 1%

    seeddms · seeddmsJul 31, 2018

  • CVE-2022-28478
    26Monitor

    SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal.

    MediumCVSS 6.5No exploitEPSS 1%

    seeddms · seeddmsJun 6, 2022

  • CVE-2019-12801
    25Monitor

    out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    seeddms · seeddmsJun 17, 2019

  • CVE-2018-12943
    24Monitor

    Cross-Site Scripting (XSS) vulnerability in every page that includes the "action" URL parameter in SeedDMS (formerly LetoDMS and MyDMS) befo

    MediumCVSS 6.1No exploitEPSS 1%

    seeddms · seeddmsJul 31, 2018

  • CVE-2018-12944
    24Monitor

    Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows

    MediumCVSS 6.1No exploitEPSS 1%

    seeddms · seeddmsJul 31, 2018

  • CVE-2019-12932
    24Monitor

    A stored XSS vulnerability was found in SeedDMS 5.1.11 due to poorly escaping the search result in the autocomplete search form placed in th

    MediumCVSS 6.1No exploitEPSS 0%

    seeddms · seeddmsJun 28, 2019

  • CVE-2020-23048
    24Monitor

    SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via th

    MediumCVSS 6.1No exploitEPSS 0%

    seeddms · seeddmsOct 22, 2021

  • CVE-2020-28727
    24Monitor

    Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.

    MediumCVSS 6.1No exploitEPSS 0%

    seeddms · seeddmsDec 7, 2020

  • CVE-2020-28726
    24Monitor

    Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.

    MediumCVSS 6.1No exploitEPSS 0%

    seeddms · seeddmsNov 24, 2020

  • CVE-2021-45408
    24Monitor

    Open Redirect vulnerability exists in SeedDMS 6.0.15 in out.Login.php, which llows remote malicious users to redirect users to malicious sit

    MediumCVSS 6.1No exploitEPSS 0%

    seeddms · seeddmsFeb 4, 2022

  • CVE-2021-39425
    24Monitor

    SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability.

    MediumCVSS 6.1No exploitEPSS 0%

    seeddms · seeddmsJul 20, 2023

  • CVE-2021-39421
    24Monitor

    A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa

    MediumCVSS 6.1No exploitEPSS 0%

    seeddms · seeddmsJul 24, 2023

  • CVE-2019-12745
    22Monitor

    out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.

    MediumCVSS 5.4Proof of conceptEPSS 2%

    seeddms · seeddmsJun 20, 2019

  • CVE-2014-2278
    21Monitor

    Unrestricted file upload vulnerability in op/op.AddFile2.php in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allows remote attackers to

    MediumCVSS 5.1No exploitEPSS 3%

    seeddms · seeddmsOct 17, 2014

  • CVE-2022-28051
    21Monitor

    The "Add category" functionality inside the "Global Keywords" menu in "SeedDMS" version 6.0.18 and 5.1.25, is prone to stored XSS which allo

    MediumCVSS 5.4No exploitEPSS 0%

    seeddms · seeddmsJun 6, 2022

  • CVE-2025-25461
    21Monitor

    A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    seeddms · seeddmsFeb 28, 2025

  • CVE-2024-46409
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting

    MediumCVSS 5.4No exploitEPSS 0%

    seeddms · seeddmsOct 4, 2024