High severity7.3NVD Advisory· Published Sep 3, 2026· Updated Sep 3, 2026

CVE-2026-85137

Description

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

T Chachamaru/Seacms 13.6 Security Advisoriesreferences
T Chachamaru/seacms-13.6-security-advisoriesllm-fuzzy
Range: <=13.6
Seacms/Seacmsllm-fuzzy
Range: <=13.6

Patches

Vulnerability mechanics

References

github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/d-001-locoy-default-password-template-rce.mdnvd
vuldb.com/cve/CVE-2026-85137nvd
vuldb.com/submit/892792nvd
vuldb.com/vuln/398364nvd
vuldb.com/vuln/398364/ctinvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000