Description

A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T02:17:02.817Z",
  "pubdate": "2026-08-31T02:17:02.817Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists in SeaCMS up to version 13.6, specifically affecting the /err.php file.\nThe vulnerability occurs due to improper neutralization of user-supplied input provided via the 'errtxt' parameter.\nThis flaw allows remote, unauthenticated attackers to inject malicious JavaScript into the victim's browser context.\nSuccessful exploitation can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, or defacement of the affected application.\nGiven that the exploit is publicly available, the risk to organizations running vulnerable versions of SeaCMS is elevated, requiring immediate attention to mitigate potential exploitation.",
  "technicalDetails": "The vulnerability is a classic reflected XSS flaw located within the /err.php component of SeaCMS (versions up to 13.6).\nThe root cause of this vulnerability is the failure of the application to properly sanitize or validate the 'errtxt' argument before reflecting it directly back to the user's browser in an HTTP response.\nBecause the input is not appropriately encoded for the context in which it is rendered, an attacker can craft a URL containing malicious script tags or JavaScript event handlers within the 'errtxt' parameter.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious URL targeting the /err.php endpoint with a specifically designed payload in the 'errtxt' parameter; 2) The attacker induces a target user to click this URL through social engineering or other means; 3) The server receives the request and reflects the attacker-supplied payload within the generated HTML response; 4) The victim's web browser parses the response and executes the injected script.\nThis vulnerability is remotely exploitable without requiring authentication or specific user privileges. The scope of the attack is limited by the victim's session; however, because the application reflects the payload, any user (including administrators) who clicks the malicious link is susceptible to the payload's execution.\nUpon successful exploitation, the injected script executes within the security context of the origin domain. This permits the attacker to bypass Same-Origin Policy (SOP) constraints related to the affected page, facilitating activities such as accessing document cookies (if not protected by HttpOnly flags), manipulating the DOM structure, or exfiltrating sensitive information displayed on the page to an attacker-controlled server.\nThe lack of input sanitization in /err.php represents a significant security failure, as it allows arbitrary JavaScript execution whenever the application attempts to render the error message contained in the 'errtxt' parameter."
}