Flower

**Name of the Vulnerable Software and Affected Versions** SeaCMS versions prior to 13.7 **Description** A security flaw allows remote attackers to perform SQL injection, a technique used to interfere with the queries that an application makes to its database. The issue exists in the `/zyapi.php?ac=videolist` endpoint when manipulating the `ids` variable. **Recommendations** Update SeaCMS to a version later than 13.6. As a temporary workaround, restrict access to the `/zyapi.php?ac=videolist` endpoint or avoid using the `ids` variable until the software is updated.