CVE-2026-82600: SeaCMS zyapi.php sql injection

Q: Which deployments are exposed to remote exploitation?

SeaCMS installations up to version 13.6 are affected where the /zyapi.php?ac=videolist endpoint is reachable. The issue can be attacked remotely without privileges or user interaction.

Q: What input must an attacker control?

An attacker manipulates the ids argument supplied to /zyapi.php?ac=videolist to trigger SQL injection.

Q: How urgent is remediation?

Public exploit code is available, and the vulnerability has high severity with low attack complexity. Treat externally reachable affected installations as a priority for remediation.

Published Aug 31, 2026

Updated

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Affected Software

1 affected component

SEACMS SEACMS<=13.6

Event History

Aug 31, 2026

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

SeaCMS installations up to version 13.6 are affected where the /zyapi.php?ac=videolist endpoint is reachable. The issue can be attacked remotely without privileges or user interaction.

What input must an attacker control?

An attacker manipulates the ids argument supplied to /zyapi.php?ac=videolist to trigger SQL injection.

How urgent is remediation?

Public exploit code is available, and the vulnerability has high severity with low attack complexity. Treat externally reachable affected installations as a priority for remediation.

CVE-2026-82600: SeaCMS zyapi.php sql injection

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What input must an attacker control?

How urgent is remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What input must an attacker control?

How urgent is remediation?