Join us January 28th for the first In the Wild with VulnCheck webinar
Register now
Products
Government
Resources
Community
Company
Partners
Sign In / Join
Sign In
Advisories
Seacms 11.1 - 'checkuser' Stored XSS
Go Back
severity
medium
date
January 25, 2026
Affecting
Seacms <= 11.1
CVE
CVE-2020-36932
CWE
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS
5.1
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References
ExploitDB-49251
Official Seacms Product Homepage
Credit
j5s
Description
SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded.