CVE-2025-50592

7th percentile - higher than 7% of all known CVEs

A Cross-Site Scripting (XSS) vulnerability was found in SeaCMS before version 13.2 via the 'vid' parameter in Upload/js/player/dmplayer/player. It allows a remote attacker to inject malicious JavaScript code into the page.

An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or perform other actions in the victim's browser context, compromising data confidentiality and integrity.

Immediately update SeaCMS to version 13.2 or later, which includes a fix for the XSS vulnerability. Additionally, implement input filtering and validation for the 'vid' parameter.