An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentially any file accessible on the server’s root directory.
References
| Link | Resource |
|---|---|
| https://snowhy77.github.io/2025/08/21/Information-Disclosure-Vulnerability-in-SeaCMS/ | Exploit Third Party Advisory |
Configurations
History
08 Oct 2025, 15:20
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:seacms:seacms:13.1:*:*:*:*:*:*:* | |
| References | () https://snowhy77.github.io/2025/08/21/Information-Disclosure-Vulnerability-in-SeaCMS/ - Exploit, Third Party Advisory | |
| First Time |
Seacms seacms
Seacms |
03 Oct 2025, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-200 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.9 |
03 Oct 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-03 14:15
Updated : 2025-10-08 15:20
NVD link : CVE-2025-60449
Mitre link : CVE-2025-60449
CVE.ORG link : CVE-2025-60449
JSON object : View
Products Affected
seacms
- seacms
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor