What is the CVSS score of CVE-2026-85137?

CVE-2026-85137 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2026-85137?

Yes, a public proof-of-concept exploit is available for CVE-2026-85137. Prioritise patching immediately. EPSS: 0.5%.

SeaCMS CVE-2026-85137

EUVD-2026-70519 MEDIUM

Code Injection (CWE-94)

2026-09-03 VulDB

GHSA-5vx2-6w33-p69c

PHP RCE Code Injection Seacms N A

5.5

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send HTTP request to seacms_locoy_news.php
Delivery

Inject PHP payload in pwd parameter
Exploit

parseIf passes input to eval()-equivalent sink
Execution

Execute arbitrary PHP as web server user
Impact

Read/write server filesystem and exfiltrate data

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The Locoy Collector module (`seacms_locoy_news.php`) must be reachable over the network - if this is a default-installed component in SeaCMS, no special configuration beyond a standard installation is required. The CVSS 4.0 PR:N and AC:L indicate no authentication or elevated access is needed. The PoC filename ('locoy-default-password-template-rce') suggests the `pwd` parameter may accept a default, empty, or predictable value that gates the template evaluation path - an attacker supplies this value directly in the request to reach the vulnerable `parseIf` evaluation sink. Exploitation is limited to installations running SeaCMS 13.6 or earlier with the Locoy Collector component present and publicly accessible; the extent to which this component is enabled by default versus optionally installed is not confirmed by available data.
Impact	The CVSS 4.0 attack vector attributes (AV:N/AC:L/AT:N/PR:N/UI:N) characterize this as network-exploitable, unauthenticated, and requiring no special conditions - making it trivially automatable. However, the declared impact metrics (VC:L/VI:L/VA:L) conflict sharply with the 'RCE' and 'Code Injection' tags; PHP `eval()`-class injection grants full server-side code execution and should yield C:H/I:H/A:H impacts. This discrepancy is not explained by available data and should be treated as a likely scoring understatement rather than a true impact ceiling. No EPSS score is provided, but the E:P exploit maturity combined with a public GitHub PoC makes this actively weaponizable at low effort. No CISA KEV listing - no confirmed in-the-wild exploitation - however, the low exploitation barrier means this gap could close rapidly for internet-exposed SeaCMS installations.
Exploit ScenarioDerived	An unauthenticated remote attacker sends a crafted HTTP GET or POST request to the SeaCMS Locoy Collector endpoint (`seacms_locoy_news.php`), injecting a PHP payload - such as `system('id')` - into the `pwd` parameter. The `parseIf` function passes this value to an `eval()`-equivalent sink without sanitization, executing the payload as the web server process user. The public GitHub PoC provides a working demonstration of this full exploitation path against SeaCMS 13.6.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 03, 2026

Code injection in SeaCMS's Locoy Collector module (versions up to 13.6) allows remote unauthenticated attackers to execute arbitrary PHP code by manipulating the pwd argument to the parseIf function in seacms_locoy_news.php. A publicly available proof-of-concept exploit exists, documented in a GitHub security advisory, elevating practical risk above the conservative 6.9 base score. The provided CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) conflict with the 'RCE' tag - PHP code injection in a CMS context typically yields full server-side code execution, suggesting the vendor scoring may significantly understate actual impact.

RemediationAI

No vendor-released patch version is identified in the available data - neither the VulDB report nor the GitHub advisory references an official upstream fix or patched release. Administrators running SeaCMS 13.6 or earlier should immediately restrict public access to seacms_locoy_news.php at the web server level (e.g., deny the path in .htaccess with Deny from all, or in nginx via a location block returning 403); this eliminates the attack surface with no application-level side effects unless the Locoy Collector is actively in use. If the Locoy Collector module is not operationally required, disabling or removing it entirely is the preferred mitigation. Monitor VulDB (https://vuldb.com/vuln/398364) and the GitHub advisory repository for patch availability.

Affected VersionsENISA

SeaCMS 13.4

SeaCMS 13.3

SeaCMS 13.2

SeaCMS 13.1

SeaCMS 13.6

SeaCMS 13.0

SeaCMS 13.5

Affected Packages

euvd seacms no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

SeaCMS is a PHP-based content management system widely used for Chinese-language websites. The affected component is the Locoy Collector, a news-aggregation module, specifically the parseIf function within seacms_locoy_news.php. CWE-94 (Improper Control of Generation of Code - Code Injection) indicates that the pwd parameter is passed into a code-evaluation sink - such as PHP's eval() or a template engine that interprets expressions - without adequate sanitization or escaping. The GitHub PoC filename references 'default-password-template-rce,' suggesting the pwd field may represent a password used to gate template processing, and that default or empty values may bypass intended access control, allowing attacker-controlled expressions to reach the evaluation path. The CPE string uses the vendor placeholder 'n/a' rather than a valid SeaCMS identifier.

Know when Seacms gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

vuln.today AI 9.8 CRITICAL

PHP code injection via eval() grants full server access; PR:N per CVSS 4.0 vector; impacts assessed High despite conservative vendor-provided L/L/L scoring.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Sep 03, 2026 - 16:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

CVE Published

Sep 03, 2026 - 15:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Threat Intelligence Overview

EPSS Score

0.5%

Top 59% exploitable

Prevalence

Low

Chinese-market CMS, limited global enterprise deployment footprint

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.