{"id":"CVE-2019-25778","details":"SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","modified":"2026-10-25T02:45:05.446060257Z","published":"2026-10-22T11:17:03.777Z","database_specific":{},"references":[{"type":"WEB","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/seacms-sqli.yaml"},{"type":"WEB","url":"https://www.seacms.com/"},{"type":"WEB","url":"https://www.uedbox.com/post/54561/"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/seacms-8.7-sql-injection-via-comment-api-index-php-rlist-parameter"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/projectdiscovery/nuclei-templates","events":[{"introduced":"0"},{"last_affected":"d79b0850514f6ab9c6bd1b5e8150e07a171a5f3f"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"8.7"}],"source":"DESCRIPTION"}]}}],"versions":["v8.7.0","v8.6.9","v8.6.8","v8.6.7","v8.6.6","v8.6.5","v8.6.4","v8.6.3","v8.6.2","v8.6.1","v8.6.0","v8.5.9","v8.5.8","v8.5.7","v8.5.6","v8.5.4","v8.5.3","v8.5.2","v8.5.1","v8.5.0","v8.4.9","v8.4.8","v8.4.7","v8.4.6","v8.4.5","v8.4.4","v8.4.3","v8.4.2","v8.4.1","v8.4.0","v8.3.9","v8.3.8","v8.3.7","v8.3.6","v8.3.5","v8.3.4","v8.3.3","v8.2.7","v8.3.2","v8.3.1","v8.3.0","v8.2.9","v8.2.8","v8.2.6","v8.2.5","v8.2.4","v8.2.3","v8.2.2","v8.2.1","v8.2.0","v8.1.9","v8.1.8","v8.1.7","v8.1.6","v8.1.5","v8.1.4","v8.1.3","v8.1.2","v8.1.0","v8.0.9","v8.0.8","v8.0.7","v8.0.6","v8.0.5","v8.0.4","v8.0.3","v8.0.2","v8.0.1","v8.0.0","v7.3.8","v7.3.9","v7.3.7","v7.3.6","v7.3.5","v7.3.4","v7.3.3","v7.3.2","v7.2.5","v7.3.0","v7.2.9","v7.2.8","v7.2.7","v7.0.7","v7.2.6","v7.2.4","v7.2.3","v7.2.2","v7.2.1","v7.2.0","v7.1.9","v7.1.8","v7.1.0","v7.1.7","v7.1.6","v7.1.5","v7.1.4","v7.1.3","v7.1.2","v7.1.1","v7.0.9","v7.0.8","v7.0.6","v7.0.5","v7.0.4","v7.0.3","v7.0.2","v7.0.1","v7.0.0","v6.0.9","v6.0.8","v6.0.7","v6.0.6","v6.0.5","v6.0.4","v6.0.3","v6.0.2","v6.0.1","v6.0.0","v5.0.9","v5.0.8","v5.0.7","v3.0.5","v5.0.6","v5.0.5","v4.0.0","v5.0.4","v5.0.3","v5.0.2","v5.0.1","v5.0.0","v4.0.9","v4.0.8","v4.0.7","v4.0.6","v4.0.5","v4.0.4","v4.0.3","v4.0.2","v4.0.1","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v2.0.9","v2.0.8","v2.0.7","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.0","v1.1.9","v1.1.8","v1.1.7","v1.1.6","v1.1.5","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25778.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}