CVEvulnerability
CVE-2025-25461
5.4 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-02-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document.
Affected configurations
• seeddms seeddms 6.0.29
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/RoNiXxCybSeC0101/CVE-2025-25461 Exploit, Third Party Advisory
- https://www.seeddms.org/ Product
- https://github.com/RoNiXxCybSeC0101/CVE-2025-25461 Exploit, Third Party Advisory