CVE-2024-32409
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script. The issue stems from insufficient input validation.
Risk Assessment
An attacker can take over the server, steal data, or install malware, compromising the confidentiality, integrity, and availability of the system.
Recommendation
Immediately update SEMCMS to the latest available version and implement input validation and sanitization mechanisms.
Other vulnerabilities in SEMCMS
See all- CVE-2023-37647Critical
SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the 'id' parameter in /Ant_Suxin.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2026-39170Medium
SemCms 5.0 is vulnerable to Cross-Site Request Forgery (CSRF) via a crafted POST request to /admin/semcms_user.php.
- CVE-2026-39169High
SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.
- CVE-2025-51660Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51659Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51658Medium
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter in SEMCMS_InquiryView.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51657Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Link.php. Attackers can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51656Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Link.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51655Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Quanxian.php. Attackers can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51654Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Infocategories.php. Attackers can manipulate this parameter to execute unauthorized database queries.
Original NVD description (English source)
An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script.