CVE-2025-25461

MEDIUM

5.4

Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document.

CVE Details

CVSS v3.1 Score5.4

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

Published2/28/2025

Last Modified7/9/2025

Sourcenvd

Honeypot Sightings0

Affected Products

seeddms:seeddms

Weaknesses (CWE)

CWE-79

References

https://github.com/RoNiXxCybSeC0101/CVE-2025-25461(cve@mitre.org)

https://www.seeddms.org/(cve@mitre.org)

https://github.com/RoNiXxCybSeC0101/CVE-2025-25461(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.