CVE-2026-82601

SeaCMS up to 13.6 is vulnerable to path traversal in /member.php?action=del_pl (Comment Cache component). Manipulation of itype/vid arguments allows remote attack. Exploit is public.

SeaCMS up to 13.6 has an authorization bypass vulnerability in /ass.php. The attack can be launched remotely. The exploit has been publicly disclosed.

A vulnerability in SeaCMS up to 13.6 in the file /zyapi.php?ac=videolist allows SQL injection through the ids argument. The attack can be initiated remotely, and the exploit is public.

SeaCMS up to 13.6 is vulnerable to path traversal in the unlink function in /member.php?action=chgpwdsubmit (Avatar Upload component). Manipulation of the oldpic argument allows remote attack. Exploit is publicly available.

A vulnerability in SeaCMS up to 13.6 in the parseIf function of the search.php file in the Template Engine component allows code injection through the searchtype argument. The attack can be initiated remotely, and the exploit is public.

SeaCMS version 6.56 allows remote authenticated administrators to execute arbitrary PHP code via a crafted token field to admin/admin_ping.php, which interacts with data/admin/ping.php.

SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.

An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component.

A Cross-Site Scripting (XSS) vulnerability was found in SeaCMS before version 13.2 via the 'vid' parameter in Upload/js/player/dmplayer/player. It allows a remote attacker to inject malicious JavaScript code into the page.

A remote code execution (RCE) vulnerability was discovered in SeaCMS v13.3 in the admin_files.php component. Attackers can exploit this flaw to execute arbitrary code on the server.