What is CVE-2026-85138?

CVE-2026-85138 is a high-severity vulnerability in Seacms, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.3/10. Published 2026-09-03.

How severe is CVE-2026-85138?

High severity. CVSS v3 base score is 7.3 out of 10.

SQL Injection in Seacms

CVE-2026-85138

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

Published 2026-09-03 · last modified 2026-09-03.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.004 (33.8th percentile), scored 2026-10-19.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 33.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000

Affected products

Seacms — versions 13.0, 13.1, 13.2

Weakness classification (CWE)

References

github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d5486… (exploit)
vuldb.com/cve/CVE-2026-85138 (third-party-advisory)
vuldb.com/submit/892793 (third-party-advisory)
vuldb.com/vuln/398365 (technical-description, vdb-entry)
vuldb.com/vuln/398365/cti (signature, permissions-required)

Frequently asked questions

What is CVE-2026-85138?: CVE-2026-85138 is a high-severity vulnerability in Seacms, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.3/10. Published 2026-09-03.
How severe is CVE-2026-85138?: High severity. CVSS v3 base score is 7.3 out of 10.