CVE-2025-50592 describes a cross-site scripting vulnerability in seacms before version 13.2. The issue arises from improper sanitization of the 'vid' parameter in the Upload/js/player/dmplayer/player path, enabling an attacker to inject malicious scripts. The vulnerability requires low attack complexity, privileges, and user interaction, and it affects confidentiality and integrity with no availability impact. No known exploits in the wild have been reported. No official patch or vendor advisory is provided in the available data.

Successful exploitation can lead to partial compromise of confidentiality and integrity by executing arbitrary scripts in the context of the affected application. This could allow attackers to steal sensitive information or manipulate data accessible to the user session. There is no impact on system availability. The vulnerability requires user interaction and low privileges, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable parameter or applying input validation and output encoding on the 'vid' parameter to mitigate XSS risks. Monitor vendor channels for updates regarding patches or official mitigations.