SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded.
{
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:seacms:seacms:11.1:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"range": [
{
"introduced": "11.1"
},
{
"last_affected": "11.1"
}
],
"source": "CPE_STRING"
}
],
"vendor_product": "seacms:seacms"
}
]
}