CVE-2019-25778 — SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array…
Published: 2026-10-22 · CVSS: 8.8 · CVSS 4.0
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Source: CVE Program · Revision 4a5735a5ce1315df967860b3166e2d07095a3a43