CVE-2026-85137

HIGH 7.3

SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CWE	CWE-94 CWE-74
Vendor	n/a
Product	seacms
Published	Sep 3, 2026

Stay Ahead of the Next One

Get instant alerts for n/a seacms

Be the first to know when new high vulnerabilities affecting n/a seacms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / SeaCMS

13.0 13.1 13.2 13.3 13.4 13.5 13.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/398364 vuldb.com: https://vuldb.com/vuln/398364/cti vuldb.com: https://vuldb.com/cve/CVE-2026-85137 vuldb.com: https://vuldb.com/submit/892792 github.com: https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-001-locoy-default-password-template-rce.md

Credits

🔍 T-Chachamaru (VulDB User)