CVE-2024-44920

Name of the Vulnerable Software and Affected Versions SeaCMS version 12.9

Description A cross-site scripting (XSS) issue in the admin collect news.php component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the siteurl parameter.

Recommendations For SeaCMS version 12.9, consider disabling access to the admin collect news.php component until a patch is available. Restrict the use of the siteurl parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.