What’s Vulnerable › Vulnerabilities

CVE-2019-12744

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 11.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-06-20 · updated 2026-06-17
• Weakness: CWE-434

Description

SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940.

Affected products

• Seeddms: before 5.1.11 — fixed in 5.1.11

How to fix

Upgrade to a fixed version: Seeddms 5.1.11. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/153383/SeedDMS-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/163283/Seeddms-5.1.10-Remote-Command-Execution.html
• https://secfolks.blogspot.com/2019/06/exploit-for-cve-2019-12744-remote.html
• https://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG
• http://packetstormsecurity.com/files/153383/SeedDMS-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/163283/Seeddms-5.1.10-Remote-Command-Execution.html
• https://secfolks.blogspot.com/2019/06/exploit-for-cve-2019-12744-remote.html
• https://sourceforge.net/p/seeddms/code/ci/master/tree/CHANGELOG

Get alerted when CVE-2019-12744 or the next vulnerability affects your stack