Priority HIGH 82
An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the upload.php file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01157 · Published 2024-04-03 · No fix listed CWE-434
Priority HIGH 82
SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the ID parameter in the SEMCMS_User.php component.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00756 · Published 2024-04-18 · No fix listed CWE-89
Priority HIGH 82
SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00948 · Published 2022-10-28 · No fix listed CWE-89
Priority HIGH 82
SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00948 · Published 2022-10-28 · No fix listed CWE-89
Priority HIGH 82
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00948 · Published 2022-10-28 · No fix listed CWE-89
Priority HIGH 82
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00948 · Published 2022-10-28 · No fix listed CWE-89
Priority HIGH 82
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00948 · Published 2022-10-28 · No fix listed CWE-89
Priority HIGH 76
SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00893 · Published 2022-10-28 · No fix listed CWE-89
Priority HIGH 72
A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.007 · Published 2024-06-04 · No fix listed CWE-89
Priority HIGH 72
SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00791 · Published 2024-04-03 · No fix listed CWE-89
Priority HIGH 67
SEMCMS 4.8 is vulnerable to Incorrect Access Control.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00801 · Published 2024-03-29 · No fix listed CWE-284
Priority HIGH 67
File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01122 · Published 2023-08-05 · No fix listed CWE-434
Priority HIGH 66
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0026 · Published 2025-07-14 · No fix listed CWE-89
Priority HIGH 66
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0026 · Published 2025-07-14 · No fix listed CWE-89
Priority HIGH 66
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0026 · Published 2025-07-14 · No fix listed CWE-89
Priority HIGH 66
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0026 · Published 2025-07-14 · No fix listed CWE-89
Priority HIGH 66
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0026 · Published 2025-07-14 · No fix listed CWE-89
Priority HIGH 66
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0026 · Published 2025-07-14 · No fix listed CWE-89
Priority HIGH 66
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0026 · Published 2025-07-14 · No fix listed CWE-89
Priority HIGH 66
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0026 · Published 2025-07-14 · No fix listed CWE-89
Priority HIGH 66
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.0026 · Published 2025-07-14 · No fix listed CWE-89
Priority HIGH 66
SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00609 · Published 2024-01-10 · No fix listed CWE-89
Priority MEDIUM 62
SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0074 · Published 2024-04-03 · No fix listed CWE-89
Priority MEDIUM 62
A vulnerability has been found in SEMCMS up to 4.8 and classified as critical.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0057 · Published 2024-05-07 · No fix listed CWE-89
Priority MEDIUM 57
A security vulnerability has been detected in SEMCMS 5.0.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00373 · Published 2026-01-29 · No fix listed CWE-74
Load more
THREATIST.IORead the docs