CVE-2026-82600: SQL Injection in SeaCMS

CVE-2026-82600 is a SQL injection vulnerability affecting SeaCMS versions 13.0 to 13.6. The flaw exists in the /zyapi.php?ac=videolist file, where manipulation of the 'ids' parameter allows an attacker to inject SQL commands remotely. The vulnerability has a CVSS 4.0 score of 6.9 with network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. Although exploit code has been publicly released, there is no indication of widespread exploitation. No official remediation or patch has been announced by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database of SeaCMS, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS score and the described low to low impact on confidentiality, integrity, and availability. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint and monitor for suspicious activity related to the 'ids' parameter. Avoid using affected versions in exposed environments if possible.