CVE-2018-19350: Seacms

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element.

Affected products

• Seacms Seacms: version 6.64 only

Published 2018-11-17. Last modified 2026-06-17.