CVE-2026-82601: SeaCMS err.php cross site scripting

Q: Does an attacker need an account or elevated privileges to exploit this issue?

No privileges are required, and the attack can be launched remotely. Successful exploitation requires user interaction.

Q: What security impact is indicated by the available severity metrics?

The vector indicates low integrity impact, with no confidentiality or availability impact recorded. The issue is rated medium with a CVSS score of 4.3.

Q: Is exploit code available?

Yes. The exploit has been made publicly available and could be used in attacks.

Published Aug 31, 2026

Updated

A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Affected Software

1 affected component

SEACMS SEACMS<=13.6

Event History

Aug 31, 2026

CVE Published

via MITRE·01:15 AM

Data Sourced

via MITRE·01:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need an account or elevated privileges to exploit this issue?

No privileges are required, and the attack can be launched remotely. Successful exploitation requires user interaction.

What security impact is indicated by the available severity metrics?

The vector indicates low integrity impact, with no confidentiality or availability impact recorded. The issue is rated medium with a CVSS score of 4.3.

Is exploit code available?

Yes. The exploit has been made publicly available and could be used in attacks.

CVE-2026-82601: SeaCMS err.php cross site scripting

Affected Software

Event History

Frequently Asked Questions

Does an attacker need an account or elevated privileges to exploit this issue?

What security impact is indicated by the available severity metrics?

Is exploit code available?

Company

Resources

Contact

Frequently Asked Questions

Does an attacker need an account or elevated privileges to exploit this issue?

What security impact is indicated by the available severity metrics?

Is exploit code available?