Is there a public PoC exploit available for CVE-2025-15002?

Yes, a public proof-of-concept exploit is available for CVE-2025-15002. Prioritise patching immediately. EPSS: 0.1%.

SeaCMS CVE-2025-15002

Q: What is the CVSS score of CVE-2025-15002?

CVE-2025-15002 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-21 cna@vuldb.com

PHP SQLi Seacms

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable, no auth or interaction required; impact is bounded to partial DB read/write and minor availability disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:30 vuln.today

CVE Published

Dec 21, 2025 - 23:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Such manipulation of the argument page/limit leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in SeaCMS up to version 13.3 allows unauthenticated remote attackers to manipulate the page and limit parameters in the DM player component's database abstraction layer (js/player/dmplayer/dmku/class/mysqli.class.php), yielding read and write access to the underlying database. The affected component fails to sanitize pagination inputs before constructing SQL queries, exposing database contents including user credentials and site configuration. A public proof-of-concept exploit has been disclosed, though EPSS remains low at 0.05%, reflecting the product's limited global deployment footprint.

Technical ContextAI

SeaCMS is a PHP-based content management system primarily deployed in Chinese web environments (CPE: cpe:2.3:a:seacms:seacms:*:*:*:*:*:*:*:*). The vulnerable code resides in the DM video player sub-component at js/player/dmplayer/dmku/class/mysqli.class.php, a MySQL database wrapper class used by the embedded media player module. The page and limit parameters - typical pagination inputs - are passed directly into SQL query construction without parameterization or sanitization, constituting a classic CWE-89 SQL Injection (filed under the parent CWE-74 Injection taxonomy). The CVSS 4.0 vector's PR:N and UI:N metrics confirm the endpoint is reachable without authentication or user interaction.

RemediationAI

No confirmed patched version is identified in the available intelligence; upgrade availability should be verified directly with the SeaCMS project or via the VulDB advisory at https://vuldb.com/?id.337707. As an immediate compensating control, restrict external access to the DM player endpoint path (/js/player/dmplayer/dmku/) via web server ACL or WAF rule blocking requests where page or limit parameters contain SQL metacharacters (single quotes, dashes, semicolons, UNION, SELECT). If the DM player feature is not actively used, disabling or removing the dmplayer directory eliminates the attack surface with no functional trade-off. Additionally, ensure the MySQL user account used by SeaCMS has minimal privileges (SELECT only where writes are unnecessary) to limit blast radius from a successful injection.