CVE-2021-39426

CRITICAL

Seacms 11.4 - Remote Code Execution via admin_notify.php notify1 Parameter

Title source: llm

Description

An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the action parameter equals set.

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory

https://github.com/seacms-com/seacms/issues/21

Scores

CVSS v3 9.8

EPSS 0.0088

EPSS Percentile 54.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-94

Status published

Products (1)

seacms/seacms 11.4

Published Dec 15, 2022

Tracked Since Feb 18, 2026