Description
A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in SEMCMS up to version 5.0 in the file SEMCMS_Download.php. An attacker can manipulate an undisclosed parameter in that file to inject arbitrary SQL statements. The attack can be launched remotely via crafted HTTP requests. Successful exploitation allows the attacker to read, modify, or delete data stored in the database and may lead to a full database compromise.

Affected Systems

Affected systems are installations of SEMCMS version 5.0 and earlier that contain the vulnerable SEMCMS_Download.php file. The vendor is SEMCMS; no public patch has been released yet. The vulnerability is present in all deployments of the affected product regardless of configuration.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack is remote and does not require special privileges; it relies on sending a malicious request to the vulnerable endpoint. Because the flaw is a classic SQL Injection (CWE‑74/CWE‑89), automated tools can discover and exploit it quickly, making it a realistic threat for exposed instances.

Generated by OpenCVE AI on October 12, 2026 at 09:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SEMCMS to a version that no longer contains the vulnerable SEMCMS_Download.php file or apply vendor‑provided patch if available.
  • If upgrading is not immediately possible, restrict network access to the SEMCMS_Download.php endpoint to trusted IP addresses or internal networks using web‑server access controls.
  • Implement a Web Application Firewall or input validation rule that blocks SQL injection patterns before requests reach the application.
  • Sanitize all database inputs in SEMCMS_Download.php by using parameterized queries or prepared statements if source code can be modified.

Generated by OpenCVE AI on October 12, 2026 at 09:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title SEMCMS SEMCMS_Download.php sql injection
First Time appeared Semcms
Semcms semcms
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:semcms:semcms:*:*:*:*:*:*:*:*
Vendors & Products Semcms
Semcms semcms
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Semcms Semcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T07:45:10.238Z

Reserved: 2026-10-11T10:18:19.612Z

Link: CVE-2026-108813

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-12T08:17:19.380

Modified: 2026-10-12T08:17:19.550

Link: CVE-2026-108813

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T09:30:10Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')