A valid SQL injection flaw exists in SeaCMS versions up to 13.6 through the /zyapi.php endpoint. Manipulating the 'ids' argument in a call to /zyapi.php?ac=videolist allows an attacker to inject arbitrary SQL statements, potentially yielding unauthorized database access, data exfiltration, or modification. The weakness is classified as CWE-74 (Command Injection via Improperly Handled Strings) and CWE-89 (SQL Injection). The impact is the loss of data confidentiality and integrity for the affected database systems, with possible full compromise of the website.

SeaCMS, any installations running version 13.6 or earlier. The vulnerability applies to the /zyapi.php file, specifically the 'videolist' action. No specific sub‑versions are listed, so the entire 13.6 release line is considered vulnerable.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, which suggests it is not an actively exploited threat yet. The problem can be leveraged remotely through crafted HTTP requests, and a publicly available exploit has already circulated, implying that automated exploitation is possible if the endpoint is reachable.