PT-2025-9108 · Seeddms · Seeddms

Athul S · Published 2025-02-28 · Updated 2025-07-09 · CVE-2025-25461

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SeedDMS version 6.0.29

Description A Stored Cross-Site Scripting issue exists, allowing a user or rogue admin with the "Add Category" permission to inject a malicious payload into the category name field. When a document is associated with this category, the payload is stored on the server and rendered without proper sanitization, resulting in the payload executing in the browser of any user who views the document.

Recommendations For SeedDMS version 6.0.29, as a temporary workaround, consider restricting the "Add Category" permission to trusted users until a patch is available. Additionally, avoid using the category name field for any potentially malicious input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25461

Affected Products

Seeddms

References · 8

• 🔥 https://github.com/RoNiXxCybSeC0101/CVE-2025-25461 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-25461 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25461 · Vendor Advisory
• https://seeddms.org · Note
• https://t.me/cvedetector/19175 · Telegram Post
• https://twitter.com/cybercronai/status/1895530779284766947 · Twitter Post
• https://t.me/cvenotify/128277 · Telegram Post
• https://twitter.com/CVEnew/status/1895619361207148996 · Twitter Post