CVE-2025-60449: n/a
Source CVE Database V5
Not known to be exploited · CVSS 4.9 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 30% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 3 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
To mitigate this vulnerability, European organizations should immediately audit their SeaCMS installations to identify if version 13.1 is in use and whether the admin_safe.php component is accessible. 2) Enforce strong multi-factor authentication (MFA) for all administrator accounts to reduce the risk of credential compromise. 3) Conduct thorough monitoring and logging of all administrative access and file download activities to detect suspicious behavior promptly. 4) Review and harden file permissions on the server to ensure that only necessary files are accessible by the web application user, minimizing the scope of files that can be read or downloaded. 5) Consider deploying web application firewalls (WAFs) with custom rules to detect and block abnormal requests targeting admin_safe.php. 6) Engage with SeaCMS vendors or community to track the release of official patches or updates addressing this vulnerability and plan for timely deployment. 7) Perform regular security assessments and penetration testing focusing on authenticated administrator functionalities to identify similar risks.
Description
An information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability exists in the admin_safe.php component located in the /btcoan/ directory. This security flaw allows authenticated administrators to scan and download not only the application’s source code but also potentially any file accessible on the server’s root directory.