CVE-2026-79423

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and extractvalue to extract database information via error messages.

A vulnerability was detected in SeaCMS up to 13.6. The function addslashes in the file weixin/index.php of the WeChat Module is affected. Manipulation of the argument Content results in SQL injection, which can be launched remotely.

SeaCMS version 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.

SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.

An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.

A security vulnerability has been detected in SeaCMS up to 13.6. The function parseIf in the file seacms_locoy_news.php of the Locoy Collector component is affected. Manipulation of the argument pwd leads to code injection, and the attack can be initiated remotely.

SeaCMS up to 13.6 is vulnerable to path traversal in /member.php?action=del_pl (Comment Cache component). Manipulation of itype/vid arguments allows remote attack. Exploit is public.

SeaCMS up to 13.6 has an authorization bypass vulnerability in /ass.php. The attack can be launched remotely. The exploit has been publicly disclosed.

SeaCMS up to 13.6 is vulnerable to cross-site scripting (XSS) in /err.php. Manipulation of the errtxt argument allows remote attack. Exploit is publicly available.

A vulnerability in SeaCMS up to 13.6 in the file /zyapi.php?ac=videolist allows SQL injection through the ids argument. The attack can be initiated remotely, and the exploit is public.