CVE-2022-28076

Deeper analysis

Seacms version 11.6 contains a remote command execution vulnerability that is triggered through the Mail Server Settings component. The flaw received a CVSS 3.1 base score of 7.2, reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability when successfully exploited.

An authenticated administrator or other high-privileged user can supply malicious input to the mail-server configuration fields and cause arbitrary commands to execute on the underlying server. Because the vector requires administrative credentials, the attacker must first obtain or abuse such access before achieving full system compromise.

The two public references point to the same GitHub issue that originally disclosed the flaw; neither reference contains vendor advisory text, patch details, or mitigation guidance. The associated EPSS score has remained flat at 0.0523 with no material increase after disclosure.