CVE-2026-85138: SQL Injection in SeaCMS

CVE-2026-85138 is an SQL injection vulnerability affecting SeaCMS versions 13.0 to 13.6. The flaw exists in the addslashes function of the weixin/index.php file in the WeChat Module component. By manipulating the Content argument, an attacker can inject SQL commands remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code is publicly available, but there is no official patch or remediation level provided by the vendor at this time.

Successful exploitation allows remote attackers to execute arbitrary SQL commands on the backend database via the Content parameter, potentially leading to unauthorized data access or modification. The vulnerability affects the integrity and confidentiality of the database managed by SeaCMS. No evidence of active exploitation in the wild has been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying input validation or web application firewall rules to detect and block malicious SQL injection attempts targeting the Content parameter in the WeChat Module. Monitor for updates from the SeaCMS vendor regarding patches or official mitigations.