PT-2025-52613

CVE-2025-15002

Published

2025-12-21

Updated

2025-12-30

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeaCMS versions prior to 13.4

Description A flaw exists in SeaCMS that allows for SQL injection. The issue is located in an unknown function within the js/player/dmplayer/dmku/class/mysqli.class.php file. Manipulation of the page/limit argument can lead to exploitation. The attack can be carried out remotely, and the exploit is publicly available.

Recommendations Update SeaCMS to version 13.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Yu22X

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')