Is there a public PoC exploit available for CVE-2025-15003?

Yes, a public proof-of-concept exploit is available for CVE-2025-15003. Prioritise patching immediately. EPSS: 0.0%.

SeaCMS CVE-2025-15003

Q: What is the CVSS score of CVE-2025-15003?

CVE-2025-15003 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-22 cna@vuldb.com

PHP SQLi Seacms

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:49 vuln.today

DescriptionCVE.org

A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argument e_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in SeaCMS up to version 13.3 via the e_id parameter in admin_video.php allows authenticated high-privilege attackers to execute arbitrary SQL queries and manipulate database content. The vulnerability requires administrative credentials, limiting real-world impact despite public exploit availability. EPSS score of 0.05% reflects the high privilege requirement needed for exploitation.

Technical ContextAI

SeaCMS is a content management system written in PHP. The vulnerability exists in the admin_video.php file, where the e_id parameter is not properly sanitized before being used in SQL queries. This is a classic case of improper input validation (CWE-74: Improper Neutralization of Special Elements in Output) leading to SQL injection. The vulnerability chain involves user-supplied input reaching SQL query construction without parameterized queries or adequate escaping. The CPE indicates all versions up to and including 13.3 are affected.

RemediationAI

Upgrade SeaCMS to a version newer than 13.3 if one is available from the vendor. If no patched version exists, implement the following compensating controls: (1) Restrict access to admin_video.php to specific IP addresses or require VPN-based access to admin panels, reducing the pool of potential privileged users who can be compromised; (2) disable the video management feature entirely if it is not essential to operations; (3) implement database query logging and alerting to detect anomalous SQL patterns executed by admin accounts; (4) enforce strong, unique admin credentials and rotate them regularly; (5) apply principle of least privilege by granting video admin permissions only to trusted personnel who require them. No public vendor patch URL or fix version has been confirmed from available references.