CVE-2025-44072 is a critical SQL injection flaw in SeaCMS 13.3, a PHP content management system, found in admin_manager.php. The record gives no fixed version, so check the vendor for a newer release. Until then, keep the admin area off the public internet and restrict who can reach it.
What's affected
- Product: SeaCMS, a PHP content management system.
- Affected: version 13.3 is named in the record. Other versions may be affected, so verify before assuming you are safe.
- Fixed version: not stated in the record or in the only reference, a third party write up. Check the SeaCMS site and your installed files for a newer release.
- Location: the
admin_manager.phpcomponent. - Severity: CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), rated Critical.
How to check if you're exposed
# where is SeaCMS installed, and which version file does it ship?
find /var/www -maxdepth 3 -iname "admin_manager.php" 2>/dev/null
# is the admin path reachable from outside?
curl -sI https://your-site.example/admin/ | head -n 1
The version of SeaCMS is shown in the admin dashboard footer or in the files shipped with the release. If you find the vulnerable file on a public site running 13.3, assume exposure. Review your web server and database logs for unusual requests to that file, and check the admin account list for entries you do not recognise.
To see which of your projects pull in an affected component, run the free in-browser dependency scan at gold.safeguard.sh/scan. Reachability analysis then helps you separate libraries that your code actually calls from ones that only sit in a lockfile.
What to do now
- Check the SeaCMS project for a release newer than 13.3 and apply it as soon as one exists. Back up files and the database first.
- Restrict the admin directory by IP address or put it behind a VPN or an extra authentication layer at the web server.
- Put a web application firewall in front of the site and enable rules for injection, while you wait for a fix.
- Review admin accounts, recent content changes and database users. Remove anything you cannot explain.
- Run the database account used by the site with the least privileges it needs, and avoid giving it file write rights.
Why it matters
The weakness is CWE-89, improper neutralization of special elements used in an SQL command. The page builds a database query by mixing in a value from the request, so the database cannot tell the intended query from the attacker's additions. The fix is a parameterised query, which keeps values and SQL apart.
The score is 9.8 because the vector is network, low complexity, no privileges and no user interaction. For a CMS, a SQL injection can mean reading user tables, changing content or reaching administrator credentials. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version?
The record does not give one. Check the SeaCMS site, and treat version 13.3 as vulnerable until you can confirm a newer release.
What can I do today without a patch?
Limit who can reach the admin area, add a web application firewall, and review logs and accounts.
Sources
Last reviewed: 18 October 2026.
