CVE-2024-25422

The CVE-2024-25422 entry concerns a SQL injection vulnerability in SEMCMS v.4.8. The issue affects the SEMCMS_Menu.php component and could allow a remote attacker to execute arbitrary code and access sensitive information. Several connected sources consistently describe this flaw as SQL injection...

CVE-2024-28405

SEMCMS version 4.8 is susceptible to Incorrect Access Control due to a logic flaw in the admin page. The application installs SEMCMS_Funtion.php before verifying if the admin is a valid user because the authentication function is called from the admin page itself. This allows unauthorized users t...

CVE-2024-4595

Summary: CVE-2024-4595 affects SEMCMS up to version 4.8, with the vulnerability located in the locate function of function.php. The issue enables SQL injection due to improper validation of external input, and can be exploited remotely. Multiple connected sources corroborate the vulnerable compon...

CVE-2024-36801

A SQL injection vulnerability exists in SEMCMS v.4.8 within the Download.php script. The root cause is a lack of measures to protect the SQL query structure , specifically involving the lgid parameter. This flaw allows a remote attacker to execute arbitrary SQL queries and gain unauthorized acces...

CVE-2023-48864

CVE-2023-48864 affects SEMCMS v4.8, where a SQL injection is possible via the languageID parameter in the /web_inc.php endpoint. The vulnerability description is consistently reported across multiple sources; no explicit exploit details or confirmed fixes are provided in the connected documents. ...

CVE-2024-31012

A security vulnerability exists in SEMCMS v.4.8 , a content management system for foreign trade websites. The flaw resides in the upload.php file, which allows remote attackers to execute arbitrary code , escalate privileges , and obtain sensitive information . To mitigate this risk, it is recomm...

CVE-2025-25686

The SEMCMS open source content management system, specifically versions

CVE-2024-53502

Seecms v4.8 is affected by a SQL injection vulnerability located in the SEMCMS_SeoAndTag.php page. This vulnerability arises from improper neutralization of special elements used in an SQL command, potentially allowing for SQL injection attacks. While no specific exploit code is provided, the vul...

CVE-2024-31010

A SQL injection vulnerability exists in SEMCMS v.4.8 due to improper neutralization of special elements in an SQL command. A remote attacker can exploit the ID parameter in the Banner.php file to obtain sensitive information . While no patched version is currently identified, users are advised to...

CVE-2024-52725

SemCms v4.8 is susceptible to a SQL injection vulnerability within the SEMCMS_SeoAndTag.php component. An attacker can exploit the ldgid parameter to execute arbitrary code. As a temporary workaround, it is recommended to restrict access to the affected component and avoid using the ldgid paramet...

CVE-2024-32409

SEMCMS version 4.8 is vulnerable to an issue that allows a remote attacker to execute arbitrary code via a crafted script. Rapid7 identifies this as a failure to properly neutralize input during web page generation. Currently, there is no information regarding a newer version that contains a fix ...

CVE-2023-31707

SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php. Root cause: input validation in Ant_Rponse.php missing, enabling arbitrary SQL execution. Impact: high confidentiality, integrity, and availability; CVSS 3.1 base score 9.8 (CRITICAL) with network access, no authentication, and no user...

CVE-2023-30090

Semcms Shop v4.2 is affected by an arbitrary file upload vulnerability in the SEMCMS_Upfile.php component, enabling an attacker to upload a crafted PHP file and achieve arbitrary code execution. Affected product: Semcms Shop 4.2; vulnerable component: SEMCMS_Upfile.php; root cause: improper file ...

CVE-2020-18432

CVE-2020-18432 : SEMCMS PHP version 3.7 contains a code issue that allows remote attackers to upload arbitrary files and gain escalated privileges. The available connected documents confirm the vulnerability name, affected software, and the impact (remote arbitrary file upload with elevated privi...

CVE-2021-38217

SEMCMS 1.2 is affected by a SQL Injection vulnerability in SEMCMS_User.php. The issue, documented across multiple sources (CVE-2021-38217), is classified with CVSSv3.1 base score 9.8 (CRITICAL) and is exploitable remotely without privileges or user interaction. The vulnerability stems from input ...

CVE-2021-38733

CVE-2021-38733 affects SEMCMS SHOP v1.1 with a SQL injection in Ant_BlogCat.php. All sources indicate a high-severity vulnerability (CVSS 3.1: 9.8) potentially allowing unauthorized database access without authentication. The connected documents do not provide exploit details or confirmed in-the-...

CVE-2024-31009

A SQL injection vulnerability exists in SEMCMS v.4.8 . The flaw is triggered via the lgid parameter in the Banner.php file, which allows a remote attacker to obtain sensitive information . To mitigate this risk until a patch is released, it is recommended to restrict access to the Banner.php file...

CVE-2022-2726

CVE-2022-2726 concerns SEMCMS. A SQL injection vulnerability exists in an unknown part of Ant_Check.php triggered by manipulating the DID parameter, with remote exploitation claimed. Multiple connected sources corroborate a critical severity and public exploit disclosure, affecting SEMCMS via Ant...

CVE-2021-38729

CVE-2021-38729 affects SEMCMS SHOP version 1.1. The vulnerability is a SQL Injection in Ant_Plist.php, with CVSS v3.1 base score 9.8 (CRITICAL). Public references indicate a PoC exists and potential exploitation; details in the Adp entry note a total technical impact. Pending remediation: PT-2022...

CVE-2020-23564

SEMCMS 3.9 is affected by a file upload vulnerability in SEMCMS_Upfile.php that can allow remote attackers to run arbitrary code. Root cause cited: lack of proper validation of uploaded files. Impact per sources is arbitrary code execution (high severity). Remediation: as a temporary workaround, ...

CVE-2024-46103

The SEMCMS web content management system, specifically version 4.8 , is vulnerable to SQL Injection via the SEMCMS_Main.php file. The root cause is a lack of validation for external SQL statements, which allows an attacker to execute illegal SQL commands to steal sensitive database data. As a tem...

CVE-2024-13193

CVE-2024-13193 affects SEMCMS up to v4.8, with a SQL injection in the SEMCMS_Images.php of the Image Library Management Page. The vulnerability is exploitable remotely and the exploit has been disclosed publicly; vendor response has been non-existent in the provided material. Connected sources co...

CVE-2021-38737

The CVE-2021-38737 entry concerns SEMCMS v1.1 with a SQL Injection flaw in Ant_Pro.php. The connected sources confirm the vulnerability is due to lack of validation of externally supplied SQL statements, enabling an attacker to execute arbitrary SQL and potentially exfiltrate data. No concrete re...

CVE-2024-30938

SEMCMS version 4.8 is vulnerable to a SQL Injection vulnerability (CWE-89) within the SEMCMS_User.php component. A remote attacker can exploit the ID parameter to obtain sensitive information from the system. As a temporary workaround, users should restrict access to the SEMCMS_User.php component...

CVE-2021-38734

Summary (mode C): SEMCMS SHOP version 1.1 is affected by a SQL Injection in Ant_Menu.php. The vulnerability is documented with a high-impact CVSS (CRITICAL, BOOTSTRAP: NETWORK, no privileges needed, no user interaction) affecting confidentiality, integrity, and availability. The root cause is an ...

CVE-2020-18081

The CVE-2020-18081 entry concerns SEMCMS 3.8, where the checkuser function is vulnerable to an access-control/SQL query flaw that can disclose plaintext passwords. The vulnerability allows an attacker to obtain passwords via a crafted SQL query, with network access and no authentication required ...

CVE-2021-38731

CVE-2021-38731 concerns SEMCMS SHOP v1.1, where Ant_Zekou.php is vulnerable to SQL injection due to input validation gaps. The weakness can allow an attacker to execute arbitrary SQL commands and potentially exfiltrate or manipulate database data. Documented impacts are high (health of data confi...

CVE-2021-38736

The CVE-2021-38736 entry concerns SEMCMS Shop v1.1 with a SQL injection vulnerability in Ant_Global.php. The issue is documented as a high-severity (CVSS v3.1: 9.8, CRITICAL) vulnerability affecting confidentiality, integrity, and availability (C/H/I/A). Connected sources confirm the affected com...

CVE-2021-38732

CVE-2021-38732 affects SEMCMS SHOP v1.1, with a SQL injection in Ant_Message.php. The vulnerability is rated CVSS v3.1 9.8 (CRITICAL): Network attack vector, no authentication, low complexity, no user interaction required, and impacts confidentiality, integrity, and availability. Documentation co...

CVE-2018-18742

CVE-2018-18742 concerns SEMCMS 3.4, where a cross-site request forgery (CSRF) vulnerability exists in the admin flow accessed via the URI admin/SEMCMS_User.php?Class=add&CF=user. The issue, described as CSRF, could enable unauthorized operations on behalf of an authenticated user. CVSS metrics fr...

CVE-2020-18078

CVE-2020-18078 affects SEMCMS v3.8 via a vulnerability in /include/web_check.php that allows resetting the Administrator password. Implementations in multiple feeds confirm the root cause as an access/verification issue within that script, leading to an account takeover risk for the admin account...

CVE-2021-38730

SemCMS SHOP v1.1 is affected by a SQL Injection vulnerability in Ant_Info.php (CVE-2021-38730). The issue allows unauthenticated attackers to inject SQL, with high impact to confidentiality, integrity, and availability (CVSS 3.1: CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Several connected s...

CVE-2023-37647

Summary: CVE-2023-37647 affects SEMCMS v1.5, with a SQL injection vulnerability exploitable via the id parameter in the /Ant_Suxin.php endpoint. The issue is documented across multiple sources (including CNVD, NVD, Red Hat, and CVE lists) and has a high/critical impact rating (CVSS 3.1: AV:N/AC:L...

CVE-2018-18745

CVE-2018-18745 is an XSS vulnerability in SEMCMS 3.4 exploitable via the admin/SEMCMS_Menu.php?lgid=1 page during editing. Connected sources consistently confirm a cross-site scripting issue affecting SEMCMS 3.4; no vendor/version patch details are provided in the documents. The NVD entry lists b...

CVE-2021-38728

CVE-2021-38728 affects SEMCMS SHOP v1.1, with a stored/reflected Cross-Site Scripting (XSS) vulnerability in Ant_M_Coup.php. The available sources indicate the issue resides in a web-exposed component, enabling an attacker to inject scripts that may be executed in a user’s browser, given network ...

CVE-2023-50563

Semcms v4.8 contains a SQL injection vulnerability in SEMCMS_Function.php via the AID parameter. Affected component: SEMCMS_Function.php; vulnerable input AID leads to potential unauthorized data access or modification (high/critical impact per CVSS 3.1). No exploitation details are provided in t...

CVE-2024-36800

A SQL injection vulnerability exists in SEMCMS version 4.8 . The flaw is caused by the improper neutralization of special elements used in an SQL command, specifically via the ID parameter in the Download.php file. A remote attacker can exploit this to obtain sensitive information . Remediation i...

CVE-2018-18741

CVE-2018-18741 describes a Cross-Site Scripting (XSS) vulnerability in SEMCMS 3.4, exploitable via the URI admin/SEMCMS_Download.php?lgid=1 during editing. The issue is documented across multiple sources (NVD, CNVD, CVE lists) with the impact characteristics: confidentiality impact LOW, integrity...

CVE-2018-18743

CVE-2018-18743 affects SEMCMS 3.4 and is a Cross-Site Scripting (XSS) vulnerability exploitable via the second text field in the admin/SEMCMS_Categories.php?pid=1&lgid=1 URI. NVD metrics show CVSS v2 base score 3.5 (LOW) with NETWORK attack vector, MEDIUM complexity, and partial integrity impact;...

CVE-2019-11518

CVE-2019-11518 affects SEMCMS 3.8 with a SQL injection in SEMCMS_Inquiry.php due to incomplete protection in class.phpmailer.php inject_check_sql. The root cause is an incomplete safeguard allowing AID[] manipulation to inject SQL. CVSS metrics (NVD) list a v3 base score 7.2 (HIGH), network attac...

CVE-2023-48863

CVE-2023-48863 affects SEMCMS 3.9. The vulnerability is an SQL Injection caused by insufficient input validation, allowing injected SQL to execute on the backend database. Exploitation status is not documented in the provided sources. Potential remediation noted in PT-2023-30991 suggests implemen...

CVE-2018-18783

CVE-2018-18783 affects SEMCMS V3.4. A reflected/DOM-like cross-site scripting vulnerability is exploitable through the semcms_remail.php?type=ok umail parameter, enabling injection of arbitrary scripts via this input. The vulnerability is documented with CVSS base scores (2.0/4.3 and 3.0/6.1) ind...

CVE-2018-18740

CVE-2018-18740 describes a cross-site scripting (XSS) vulnerability in SEMCMS 3.4. The issue occurs in the first input field when accessing the URI admin/SEMCMS_Link.php?lgid=1, allowing injection of arbitrary script/HTML. Connected sources (NVD/NVDC/CVE records and CNVD/PRION entries) consistent...

CVE-2018-20017

CVE-2018-20017 affects SEMCMS 3.5. The vulnerability is a cross-site scripting (XSS) flaw exploitable via the first text box on the SEMCMS_Main.php URI. This is confirmed in multiple sources (NVD description and CNVD-2019-05836), which state attackers can use the vulnerability through that input ...

CVE-2018-18739

CVE-2018-18739 affects SEMCMS 3.4, with a cross-site scripting vulnerability in the admin/SEMCMS_Products.php?lgid=1 Keywords field. The issue is documented across multiple sources (NVD, CNVD, CVE lists). The connected documents confirm the vulnerable component is the Keywords input in SEMCMS 3.4...

CVE-2018-18841

CVE-2018-18841 concerns an XSS vulnerability in SEMCMS PHP v3.4. The flaw stems from the SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag tag_indexkey parameter, allowing script injection via that input. Affected software: SEMCMS PHP 3.4 (as described). The connected documents confirm the vulnerabili...

CVE-2018-18744

CVE-2018-18744 describes a cross-site scripting (XSS) vulnerability in SEMCMS 3.4 . The issue is exploitable via the fifth text box in the path to the URI admin/SEMCMS_Main.php , enabling an attacker to inject arbitrary script/HTML. The provided data cites an XSS impact with low to medium severit...

CVE-2018-18738

An XSS vulnerability (CVE-2018-18738) affects SEMCMS 3.4, exploitable via the admin/SEMCMS_Categories.php?pid=1&lgid=1&category_key parameter. The vulnerability is due to unsafely handled input in the category_key field, enabling injection of arbitrary web script/HTML. Reported impact metrics ind...

CVE-2018-18840

CVE-2018-18840 is a cross-site scripting (XSS) vulnerability in SEMCMS PHP v3.4, triggered via the parameter tag_indexmetatit in SEMCMS_SeoAndTag.php?Class=edit&CF=SeoAndTag. Multiple connected sources corroborate the issue and identify the affected software as SEMCMS PHP v3.4. The vulnerability ...

CVE-2025-51652

Summary: CVE-2025-51652 affects SemCms v5.0, where a SQL injection can be triggered via the pid parameter in SEMCMS_Categories.php. The vulnerability is confirmed across multiple sources (NVD, Red Hat, CVE list, PT Security, CNNVD, etc.). Impact: confidentiality and integrity impacts are listed a...