Description
A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-23
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: client-side cross-site scripting
Action: Assess Impact
AI Analysis

Impact

The vulnerability exists in the upload_json.php script of the KindEditor Upload interface in SEMCMS, where the imgFile argument can be manipulated to inject arbitrary JavaScript. This allows a malicious actor to execute code in the browsers of users who view the affected content. The flaw was demonstrated as a classic cross‑site scripting issue.

Affected Systems

SEMCMS versions 4.2 and earlier are affected. The component under attack is the /Edit/php/upload_json.php file of the KindEditor Upload interface.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk level for the vulnerability. The CVE description states the attack may be initiated remotely, and an exploit has been published. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited commercial exploitation at present.

Generated by OpenCVE AI on September 24, 2026 at 01:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SEMCMS to a version beyond 4.2 once a vendor fix is released.
  • If an upgrade is not possible, enforce strict validation of the imgFile parameter, ensuring only allowed file types and names are accepted, and strip or encode any executable code before storing or rendering it.
  • Configure the application to serve uploaded files with appropriate MIME types and enable a Content-Security-Policy that restricts inline scripts and the execution of untrusted code.
  • Deploy a web application firewall rule that detects and blocks suspicious JavaScript content in responses from the upload endpoint.
  • Continuously monitor application logs for abnormal upload activity or errors related to script execution.

Generated by OpenCVE AI on September 24, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Sem-cms
Sem-cms semcms
Vendors & Products Sem-cms
Sem-cms semcms

Wed, 23 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title SEMCMS KindEditor Upload upload_json.php cross site scripting
First Time appeared Semcms
Semcms semcms
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:semcms:semcms:*:*:*:*:*:*:*:*
Vendors & Products Semcms
Semcms semcms
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sem-cms Semcms
Semcms Semcms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-24T15:48:20.573Z

Reserved: 2026-09-23T15:42:06.965Z

Link: CVE-2026-96739

cve-icon Vulnrichment

Updated: 2026-09-24T15:46:13.695Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T00:17:22.990

Modified: 2026-09-24T21:08:55.030

Link: CVE-2026-96739

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:00:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')