PT-2025-52613 · Seacms · Seacms

Yu22X · Published 2025-12-21 · Updated 2025-12-30 · CVE-2025-15002

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeaCMS versions prior to 13.4

Description A flaw exists in SeaCMS that allows for SQL injection. The issue is located in an unknown function within the js/player/dmplayer/dmku/class/mysqli.class.php file. Manipulation of the page/limit argument can lead to exploitation. The attack can be carried out remotely, and the exploit is publicly available.

Recommendations Update SeaCMS to version 13.4 or later.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-15002

Affected Products

Seacms

References · 13

• 🔥 https://note-hxlab.wetolink.com/share/VFwALb6qhnTZ · Exploit
• https://osv.dev/vulnerability/CVE-2025-15002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15002 · Security Note
• https://vuldb.com/?id.337707 · Note
• https://t.me/cveNotify/146476 · Telegram Post
• https://vuldb.com/?ctiid.337707 · Note
• https://t.me/cveNotify/147239 · Telegram Post
• https://twitter.com/CVEnew/status/2003198637443109031 · Twitter Post
• https://twitter.com/vuldb/status/2003011136380375067 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002886306368557542 · Twitter Post
• https://vuldb.com/?submit.716083 · Note
• https://twitter.com/cracbot/status/2004507544291860722 · Twitter Post
• https://t.me/CVEtracker/40378 · Telegram Post