CVE-2025-4257: SeaCMS admin_pay.php cross site scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-05 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file /admin_pay.php. The manipulation of the argument cstatus leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

SeaCMS: 13.2

References

https://github.com/seacms-net/CMS/issues/26
https://github.com/seacms-net/CMS/issues/26#issue-3007084603
https://vuldb.com/?ctiid.307361
https://vuldb.com/?id.307361
https://vuldb.com/?submit.562719

Get alerted when CVE-2025-4257 or the next vulnerability affects your stack