CVE-2019-25778 SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2019-25778?
CVE-2019-25778 is a high-severity vulnerability in SeaCMS, published on 22 Oct 2026.
Official description
SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Weakness: CWE-89
Which versions are affected by CVE-2019-25778?
How do I fix CVE-2019-25778?
No fix has been published for CVE-2019-25778 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-25778 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25778 exists.
Sources
Also known as GHSA-x45m-w3f3-v256.