Description
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Published: 2026-09-03
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the SeaCMS WeChat module, specifically within the addslashes function in weixin/index.php. By manipulating the Content argument, an attacker can inject malicious SQL statements. This flaw allows remote exploitation, enabling the execution of arbitrary database queries that could reveal sensitive data, modify records, or compromise the integrity of the application database. The weakness is a classic SQL injection as identified by CWE-89 and an input handling issue related to string escaping, represented by CWE-74.

Affected Systems

SeaCMS versions up to and including 13.6 are affected. The flaw is present in the default installation of the WeChat module for SeaCMS. No additional sub‑versions or variants were identified in the advisory.

Risk and Exploitability

The CVSS score of 6.9 categorizes the issue as medium severity. The exploit is publicly disclosed, and attackers can reach the vulnerable endpoint remotely via the web interface. While EPSS data are not available, the lack of mitigation and the public nature of the exploit elevate the practical risk. This vulnerability is not listed in the CISA KEV catalog, but organizations should treat it as actionable until a patch is deployed.

Generated by OpenCVE AI on September 3, 2026 at 21:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SeaCMS to a version released after 13.6 where the addslashes input handling has been corrected; apply the vendor’s official patch if available.
  • Implement strict input validation on the Content parameter, restricting allowed characters and enforcing length limits to prevent injection payloads.
  • Deploy or configure a web application firewall rule that detects and blocks suspicious SQL statements targeting the Content parameter of weixin/index.php.
  • If the WeChat module is not required for business operations, consider disabling or uninstalling it to remove the attack surface.

Generated by OpenCVE AI on September 3, 2026 at 21:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Title SeaCMS WeChat index.php addslashes sql injection
First Time appeared Seacms
Seacms seacms
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:seacms:seacms:*:*:*:*:*:*:*:*
Vendors & Products Seacms
Seacms seacms
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Seacms Seacms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-03T15:55:51.810Z

Reserved: 2026-09-03T09:10:59.425Z

Link: CVE-2026-85138

cve-icon Vulnrichment

Updated: 2026-09-03T15:55:43.883Z

cve-icon NVD

Status : Deferred

Published: 2026-09-03T16:18:26.677

Modified: 2026-09-03T17:25:25.113

Link: CVE-2026-85138

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T21:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')