Skip to main content

Seacms EUVDEUVD-2025-19488

| CVE-2025-6864 LOW
Cross-Site Request Forgery (CSRF) (CWE-352)
2025-06-29 cna@vuldb.com
PHP CSRF Seacms
2.1
CVSS 4.0 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-352
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK

1 technique across 1 tactic: Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).
No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 26, 2026

Cross-site request forgery in SeaCMS admin panel (/admin_type.php) allows remote attackers to trick authenticated administrators into performing unintended actions. All versions up to 13.2 are affected. A public exploit is available, but the vulnerability is not known to be actively exploited; EPSS probability is very low (0.06%).

Earlier versions of this analysis (1)
v1 Mar 16, 2026 - 01:15 CVSS 4.3

Affected VersionsENISA

SeaCMS 13.2
SeaCMS 13.0
SeaCMS 13.1

Affected Packages

euvd seacms no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Seacms gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
Passive
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
Low
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

5
Severity Changed
Apr 29, 2026 - 01:11 NVD
MEDIUM LOW
CVSS changed
Apr 29, 2026 - 01:11 NVD
4.3 (MEDIUM) 2.1 (LOW)
PoC Detected
Jul 01, 2025 - 12:27 vuln.today
Public exploit code
CVE Published
Jun 29, 2025 - 16:15 cve.org
LOW 2.1
CVE Published
Jun 29, 2025 - 16:15 nvd
MEDIUM 4.3

DescriptionCVE.org

A vulnerability, which was classified as problematic, has been found in SeaCMS up to 13.2. Affected by this issue is some unknown functionality of the file /admin_type.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

Organizations using SeaCMS should be aware of moderate risk from CVE-2025-6864, a cross-site request forgery vulnerability rated CVSS 4.3. Users could be tricked into performing unintended actions. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.

Recommended Action

Within 30 days: Identify affected systems running SeaCMS and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: implement SameSite cookie attributes and anti-CSRF tokens.

Threat Intelligence Overview

EPSS Score
0.1%
Top 82% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity LOW
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available No
Active threat No
Deciding rule
LOW severity (CVSS 0.1-3.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Low

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +10
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Request Forgery MEDIUM

Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.

More in Seacms

View all
CVE-2025-44071 CRITICAL POC
9.8 May 05

SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. Rated
CVE-2024-54879 CRITICAL POC
9.1 Jan 06

SeaCMS V13.1 is vulnerable to Incorrect Access Control. Rated critical severity (CVSS 9.1), this vulnerability is remote
CVE-2025-22974 CRITICAL POC
9.8 Feb 24

SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTra
CVE-2025-25521 CRITICAL POC
9.8 Feb 25

Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php. Rated critical severity (CVSS 9.8), this vulnerabil
CVE-2025-25520 CRITICAL POC
9.8 Feb 25

Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2025-25519 CRITICAL POC
9.8 Feb 25

Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php. Rated critical severity (CVSS 9.8), this vulnerability is
CVE-2025-25517 CRITICAL POC
9.8 Feb 25

Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php. Rated critical severity (CVSS 9.8), this vulnerability
CVE-2025-25516 CRITICAL POC
9.8 Feb 25

Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php. Rated critical severity (CVSS 9.8), this vulnerability
CVE-2025-25513 CRITICAL POC
9.8 Feb 24

Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php. Rated critical severity (CVSS 9.8), this vulnerabilit
CVE-2025-44073 CRITICAL POC
9.8 May 06

SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php. Rated cri
CVE-2025-44074 CRITICAL POC
9.8 May 05

SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php. Rated critical s
CVE-2025-44072 CRITICAL POC
9.8 May 05

SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php. Rated critical

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2017-9757 HIGH POC
8.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-6864 REF https://vuldb.com/?ctiid.314336 REF https://vuldb.com/?id.314336 REF https://vuldb.com/?submit.603562

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy