SemCms 5.0 is vulnerable to Cross‑Site Request Forgery through a crafted POST request to the /admin/semcms_user.php endpoint. An attacker who can subvert a user's authenticated session could manipulate or create user accounts without authorization, potentially leading to privilege escalation or denial of service within the application. The weakness stems from insufficient validation of the request source, allowing an attacker to force the victim’s browser to send state‑changing requests.

The vulnerability affects SemCms version 5.0. No additional vendor or version details are provided, and the CPE information is unavailable.

The lack of EPSS data and a KEV listing suggest no current evidence of widespread exploitation, but the high impact of CSRF in a web application involving sensitive admin functions means that exploitation could occur from any HTTP client with the victim’s cookies. The attack vector is network‑based, reliant on a victim’s authenticated session and the absence of CSRF tokens or proper origin checks.