CVE-2026-85138

Name of the Vulnerable Software and Affected Versions SeaCMS versions prior to 13.7

Description An issue exists in the WeChat Module within the file weixin/index.php. The addslashes() function fails to properly sanitize the Content argument, allowing a remote attacker to perform SQL injection. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update SeaCMS to a version later than 13.6. As a temporary mitigation, restrict access to the weixin/index.php file or avoid using the Content argument in the WeChat Module.