Security readout for executives and security teams
Plain-English summary
SeaCMS v13.3 has a reported code execution flaw involving the isopen parameter in admin_weixin.php. The supplied data rates it medium, not because code execution is harmless, but because access appears constrained by the CVSS vector: local access and low privileges are required.
Executive priority
Treat this as a focused remediation item for any SeaCMS v13.3 deployment. It is not currently supported as an emergency internet-wide issue by the supplied evidence, but code execution risk warrants prompt inventory, access restriction, and vendor guidance review.
Technical view
CVE-2025-25792 is described as CWE-77 command injection/RCE in SeaCMS v13.3 through admin_weixin.php's isopen parameter. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. Affected CPE metadata is absent, so product/version confirmation must be manual.
Likely exposure
Exposure is most likely limited to organizations running SeaCMS v13.3, especially where administrative files are present and accessible. The source bundle does not provide CPEs, package identifiers, hosting patterns, or a vendor fix version.
Exploitation context
The CVE is not listed as KEV in the supplied bundle. A public GitHub reference is listed, indicating technical details are public, but the sources provided do not establish active exploitation in the wild.
Researcher notes
The record has incomplete affected-product metadata and a tension between the RCE description and local CVSS attack vector. Validate exposure against real deployments rather than relying on CPE matching. Avoid assuming remote unauthenticated exploitability from the title alone.
Mitigation direction
- Inventory SeaCMS deployments and confirm any v13.3 instances.
- Check SeaCMS vendor guidance for official patches or mitigations.
- Restrict access to the SeaCMS admin interface to trusted networks and users.
- Review admin account access and remove unnecessary privileges.
- Monitor logs for unusual admin_weixin.php access or parameter activity.
Validation and detection
- Confirm whether SeaCMS v13.3 is installed in production or staging.
- Verify whether admin_weixin.php exists and is reachable.
- Review access controls protecting the SeaCMS administrative area.
- Check vendor and CVE records for updated remediation guidance.
- Assess logs for suspicious requests involving admin_weixin.php and isopen.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-25792 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N1.82.5CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.4MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.seacms.com/CVE reference, mitre
- https://github.com/Ka7arotto/Seacms/blob/main/seacmsv13.3-rce-1.mdCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.