CVE-2025-25461

A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server and rendered without proper sanitization or output encoding. This results in the XSS payload executing in the browser of any user who views the document.

• CWE-79

• https://github.com/RoNiXxCybSeC0101/CVE-2025-25461Exploit, Third Party Advisory
• https://www.seeddms.org/Product
• https://github.com/RoNiXxCybSeC0101/CVE-2025-25461Exploit, Third Party Advisory

Published

Feb 28, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25455Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overf…7.5
• CVE-2025-25456Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overf…9.8
• CVE-2025-25457Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overf…7.5
• CVE-2025-25458Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overf…4.6
• CVE-2025-2546A vulnerability classified as problematic was found in D-Lin…5.3
• CVE-2025-25460A stored Cross-Site Scripting (XSS) vulnerability was identi…4.8
• CVE-2025-25462A SQL Injection vulnerability was found in /admin/add-proper…5.5
• CVE-2025-25467Insufficient tracking and releasing of allocated used memory…9.8
• CVE-2025-25468FFmpeg git-master before commit d5873b was discovered to con…6.5
• CVE-2025-25469FFmpeg git-master before commit d5873b was discovered to con…6.5
• CVE-2025-2547A vulnerability, which was classified as problematic, has be…5.3
• CVE-2025-25471FFmpeg git master before commit fd1772 was discovered to con…4.3