Seopanel is a search engine optimization platform with a narrow product scope, centered on its SEO Panel software, that serves a specialized market of digital agencies and webmasters. The vendor's vulnerability profile is anchored in web-application input-handling and request-validation weaknesses: cross-site scripting, SQL injection, server-side request forgery, and cross-site request forgery recur across its disclosures, alongside information-disclosure risks in error messaging, reflecting the challenges of building accessible web interfaces with complex backend logic. Despite its focused footprint, the product's prevalence in SEO workflows places it among more prominent vendors in the vulnerability landscape, and its vulnerabilities frequently acquire public exploit code that amplifies the practical risk for unpatched deployments. Defenders deploying or supporting this software should prioritize input-validation and request-origin testing in internal security reviews and track vendor patches closely; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Seopanel over time
Signals from CVEs in this vendor scope (24 CVEs).
24 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-28419HIGH The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases. | Mar 18, 2021 | 7.2 | 39 | NO | YES |
CVE-2021-3002MEDIUM Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter. | Jan 1, 2021 | 6.1 | 34 | NO | YES |
CVE-2020-27461HIGH A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. This vulnerability allowed for remote code execution through an authenticated file upload via the | Aug 20, 2021 | 8.8 | 27 | NO | NO |
CVE-2021-28420MEDIUM A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter. | Mar 18, 2021 | 4.8 | 27 | NO | YES |
CVE-2021-28418MEDIUM A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter. | Mar 18, 2021 | 4.8 | 27 | NO | YES |
CVE-2021-28417MEDIUM A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter. | Mar 18, 2021 | 4.8 | 27 | NO | YES |
CVE-2010-4331MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Seo Panel 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) default_news or (2) sponsors cookie | Jan 20, 2011 | 4.3 | 27 | NO | YES |
CVE-2017-10839HIGH SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors. | Aug 29, 2017 | 8.8 | 26 | NO | NO |
CVE-2021-34117HIGH SQL Injection vulnerability in SEO Panel 4.9.0 in api/user.api.php in function getUserName in the username parameter, allows attackers to gain sensitive information. | Feb 15, 2023 | 7.5 | 24 | NO | NO |
CVE-2021-39413MEDIUM Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, | Nov 5, 2021 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (24 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Seopanel.
Media articles that mention a CVE ID that affects a product developed by Seopanel — matched by CVE ID, not by vendor name.