CVE-2023-0960

SeaCMS Picture Management config.ftp.php deserialization

4.7 Medium

A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /data/config.ftp.php of the component Picture Management. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-221630 is the identifier assigned to this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.98%Unchanged since Feb 23, 2023

What each source reports

CVE List Score used4.7

SeaCMS Picture Management config.ftp.php deserialization

Record: CVE-2023-0960
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS 3.0: 4.7 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0: 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2023-129454.7

Record: EUVD-2023-12945
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hhp2-4jg9-9w8mNo score

A vulnerability was found in SeaCMS 11.6 and classified as problematic. Affected by this issue is...

Record: GHSA-hhp2-4jg9-9w8m
Weakness: CWE-502
Updated: 2026-11-02

NVD4.7

Record: CVE-2023-0960
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 5.8 MediumAV:N/AC:L/Au:M/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

OSV4.7

SeaCMS Picture Management config.ftp.php deserialization

Record: CVE-2023-0960
CVSS 3.1: 4.7 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-502
Updated: 2026-11-02

Affected products

seacms

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-0960 is a medium vulnerability (CVSS 4.7) in Seacms, published February 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. No source names a fixed version.