CVE-2025-4257: SeaCMS admin_pay.php cross site scripting

Published May 5, 2025

Updated

A vulnerability, which was classified as problematic, has been found in SeaCMS 13.2. This issue affects some unknown processing of the file /adminpay.php. The manipulation of the argument cstatus leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected Software

2 affected components

SEACMS SEACMS

SEACMS SEACMS=13.2

Event History

May 5, 2025

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-4257?

CVE-2025-4257 is classified as a problematic vulnerability due to the potential for cross-site scripting attacks.

How do I fix CVE-2025-4257?

To fix CVE-2025-4257, ensure proper input validation and output encoding in the processing of the /admin_pay.php file.

Who is affected by CVE-2025-4257?

CVE-2025-4257 affects users of SeaCMS version 13.2 that utilize the /admin_pay.php file.

What type of attack can be executed via CVE-2025-4257?

CVE-2025-4257 can be exploited to perform cross-site scripting (XSS) attacks remotely.

Can CVE-2025-4257 be exploited without authentication?

Yes, CVE-2025-4257 can be exploited remotely, potentially without any authentication.