Vulnerability · Published Sep 3, 2026 · Assigned by VulDB
CVE-2026-85137SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection
High 7.3
In plain English
A high-severity code injection in SeaCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.5%top 55.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Affected products (as reported)
Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-398364 | SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection vdb-entry, technical-description
- VDB-398364 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-85137 | CVE Analysis and Report third-party-advisory
- Submit #892792 | SeaCMS 13.6 Code Injection third-party-advisory
- https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-001-locoy-default-password-template-rce.md exploit