CVE-2026-85138

HIGH 7.3

SeaCMS WeChat index.php addslashes sql injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

CWE	CWE-89 CWE-74
Vendor	n/a
Product	seacms
Published	Sep 3, 2026
Last Updated	Sep 3, 2026

Stay Ahead of the Next One

Get instant alerts for n/a seacms

Be the first to know when new high vulnerabilities affecting n/a seacms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / SeaCMS

13.0 13.1 13.2 13.3 13.4 13.5 13.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/398365 vuldb.com: https://vuldb.com/vuln/398365/cti vuldb.com: https://vuldb.com/cve/CVE-2026-85138 vuldb.com: https://vuldb.com/submit/892793 github.com: https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-003-weixin-xml-entity-sqli.md

Credits

🔍 T-Chachamaru (VulDB User)