CVE-2026-85137

HighCVSS 7.3/10Last modified Sep 5, 2026

Description

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2026
Last modified: Sep 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-851387.3A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat CVE-2026-85148.3Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potent CVE-2026-851469.8SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai CVE-2026-851477.5SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai CVE-2026-851489.8SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can explo CVE-2026-851495.3SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai CVE-2026-85158.3Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestu CVE-2026-851507.5A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WW CVE-2026-851527.4undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is compos CVE-2026-851539.3This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An u CVE-2026-851549.8WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer toke CVE-2026-851557.5WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allo