A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document.
History

Wed, 09 Jul 2025 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Seeddms
Seeddms seeddms
CPEs cpe:2.3:a:seeddms:seeddms:6.0.29:*:*:*:*:*:*:*
Vendors & Products Seeddms
Seeddms seeddms

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 28 Feb 2025 16:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}


Fri, 28 Feb 2025 15:30:00 +0000

Type Values Removed Values Added
Description A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document.
References

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-02-28T00:00:00.000Z

Updated: 2025-02-28T16:00:43.157Z

Reserved: 2025-02-07T00:00:00.000Z

Link: CVE-2025-25461

cve-icon Vulnrichment

Updated: 2025-02-28T16:00:38.340Z

cve-icon NVD

Status : Analyzed

Published: 2025-02-28T16:15:39.387

Modified: 2025-07-09T19:32:02.980

Link: CVE-2025-25461

cve-icon Redhat

No data.