CVE-2025-25792

MediumCVSS 4.4

Published: 26/02/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

30th percentile - higher than 30% of all known CVEs

Summary

A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 via the isopen parameter in admin_weixin.php. An attacker can send a crafted HTTP request to execute arbitrary code on the server.

Risk Assessment

The risk includes full server compromise, data theft, content manipulation, and potential use of the server for further attacks.

Recommendation

Immediately update SeaCMS to the latest available version and restrict access to the admin panel to trusted IP addresses only.

Original NVD description (English source)

SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.