CVE-2026-82600: SeaCMS zyapi.php sql injection
A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
SeaCMS installations up to version 13.6 are affected where the /zyapi.php?ac=videolist endpoint is reachable. The issue can be attacked remotely without privileges or user interaction.
What input must an attacker control?
An attacker manipulates the ids argument supplied to /zyapi.php?ac=videolist to trigger SQL injection.
How urgent is remediation?
Public exploit code is available, and the vulnerability has high severity with low attack complexity. Treat externally reachable affected installations as a priority for remediation.