SeaCMS EUVD-2026-68305

No special conditions are required for exploitation - the /zyapi.php?ac=videolist endpoint is a standard SeaCMS API handler that appears to be accessible without authentication (CVSS PR:N, UI:N, AV:N on a default installation). The only prerequisite is network reachability to the web server hosting SeaCMS. Exploitation is limited to SeaCMS versions 13.6 and below; instances not exposing the PHP application to untrusted networks (e.g., internal-only deployments behind a firewall) are not directly reachable. The impact is constrained to the database layer - no direct OS command execution is indicated by the available data.

The CVSS 4.0 score of 6.9 (Medium) with E:P (proof-of-concept) and an unauthenticated network vector places this above typical medium-severity treatment. The impact metrics (VC:L/VI:L/VA:L) are modest - the scoring likely reflects that SQL injection here does not directly yield OS-level code execution - but limited database read/write is still serious for a CMS, as it may expose user credentials, session tokens, or content data stored in the database. No CISA KEV listing exists, and EPSS data is not provided in the input, so widespread active exploitation is not confirmed. However, the public POC lowers the technical bar to near zero, meaning even opportunistic, non-targeted attackers can exploit this. The attack complexity is low, requires no privileges, and no user interaction - a mid-tier defender prioritizing by raw CVSS score alone would underweight this. The absence of KEV is the main limiting signal; without it, this is best classified as elevated risk due to POC availability rather than confirmed mass exploitation.

An unauthenticated attacker sends a crafted HTTP GET or POST request to /zyapi.php?ac=videolist&ids=1 UNION SELECT ... on an internet-exposed SeaCMS instance, injecting a SQL UNION payload to extract usernames, password hashes, or session data from the database. Because a public proof-of-concept is available at the researcher's GitHub repository, exploitation can be performed by copying and adapting the disclosed payload with no independent research required.