CVE-2025-4256: SeaCMS admin_paylog.php cross site scripting
Published May 5, 2025
·Updated
A vulnerability classified as problematic was found in SeaCMS 13.2. This vulnerability affects unknown code of the file /adminpaylog.php. The manipulation of the argument cstatus leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected Software
2 affected components
SEACMS SEACMS
SEACMS SEACMS=13.2
Event History
May 5, 2025
CVE Published
via MITRE·12:31 AM
Data Sourced
via MITRE·12:31 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-4256?
CVE-2025-4256 is classified as problematic due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2025-4256?
To fix CVE-2025-4256, ensure that input validation and output encoding are implemented in the /admin_paylog.php file.
3
What software is affected by CVE-2025-4256?
CVE-2025-4256 affects SeaCMS version 13.2.
4
Can CVE-2025-4256 be exploited remotely?
Yes, CVE-2025-4256 can be exploited remotely, allowing attackers to manipulate the cstatus argument.
5
What type of vulnerability is CVE-2025-4256?
CVE-2025-4256 is a cross-site scripting vulnerability.