SeaCMS up to version 13.6 contains a flaw in the /err.php endpoint that allows an attacker to inject arbitrary content via the errtxt parameter. The flaw is a reflected XSS vulnerability (CWE‑79) that also permits code injection (CWE‑94). By supplying a crafted errtxt value, a remote user can cause arbitrary JavaScript execution in the victim's browser, leading to session hijacking, credential theft, or defacement. The vulnerability is publicly exploitable.

All installations of SeaCMS version 13.6 or earlier are vulnerable. The flaw resides in the generic err.txt processing mechanism used by /err.php across the SeaCMS platform. Users running SeaCMS up to 13.6 should treat this as a security flaw until a patched version is released.

The CVSS base score of 5.3 places this issue in the medium severity range. There is no EPSS data, and the vulnerability is not listed in the CISA KEV catalog, but a public exploit is known. The attack vector requires remote access to the web application and careful construction of the errtxt parameter, so a threat actor with internet exposure could use this flaw. Because the flaw is reflected, successful exploitation results in client‑side effects mainly. The risk is moderate but should not be ignored.