First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-44720

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
seacms	seacms	13.1

References

https://github.com/seacms-net/CMS/issues/22Exploit, Vendor Advisory

Timeline

Published: Sep 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-447219.8SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.CVE-2024-447229.8SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.CVE-2024-447247.2AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite_url parameter at /admin/site_add.php. This vulnera CVE-2024-447257.2AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php.CVE-2024-447279.8Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.CVE-2024-447286.1Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /cli CVE-2024-447297.5Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presen CVE-2024-44735.4The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up CVE-2024-447309.1Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat CVE-2024-447314.7Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to execu CVE-2024-447347.5Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction CVE-2024-447398.8Sourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/?page=manage_user&id=.