Vulnerabilities > Seeddms > Seeddms > 5.1.7
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-12-08 | CVE-2022-44938 | Unspecified vulnerability in Seeddms 5.1.7/6.0.20 Weak reset token generation in SeedDMS v6.0.20 and v5.1.7 allows attackers to execute a full account takeover via a brute force attack. | 9.8 |
| 2021-08-03 | CVE-2021-35343 | Cross-Site Request Forgery (CSRF) vulnerability in Seeddms Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker to edit document name without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. | 4.3 |
| 2021-08-03 | CVE-2021-36542 | Cross-Site Request Forgery (CSRF) vulnerability in Seeddms Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. | 4.3 |
| 2021-08-03 | CVE-2021-36543 | Cross-Site Request Forgery (CSRF) vulnerability in Seeddms Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. | 4.3 |
| 2021-03-18 | CVE-2021-26216 | Cross-Site Request Forgery (CSRF) vulnerability in Seeddms SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php. | 4.3 |
| 2021-03-18 | CVE-2021-26215 | Cross-Site Request Forgery (CSRF) vulnerability in Seeddms SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditDocument.php. | 4.3 |
| 2019-06-20 | CVE-2019-12745 | Cross-site Scripting vulnerability in Seeddms out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field. | 3.5 |
| 2019-06-20 | CVE-2019-12744 | Unrestricted Upload of File with Dangerous Type vulnerability in Seeddms SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940. | 6.0 |
| 2018-07-31 | CVE-2018-12944 | Cross-site Scripting vulnerability in Seeddms Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the name field. | 4.3 |
| 2018-07-31 | CVE-2018-12943 | Cross-site Scripting vulnerability in Seeddms Cross-Site Scripting (XSS) vulnerability in every page that includes the "action" URL parameter in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter. | 4.3 |