CVE-2026-108812
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Improper authorization vulnerability in SEMCMS (up to 5.0) in /admin/SEMCMS_User.php?Class=Deleted&CF=user. Manipulation leads to improper authorization, remotely exploitable.
Risk Assessment
Unauthorized users may perform administrative operations such as deleting users, potentially leading to system integrity compromise and data loss.
Recommendation
Update SEMCMS to the latest version if available. Implement proper authorization mechanisms and test access to sensitive functions.
Other vulnerabilities in SEMCMS
See all- CVE-2023-37647Critical
SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the 'id' parameter in /Ant_Suxin.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2026-108814Medium
SQL injection vulnerability in SEMCMS (up to 5.0) in SEMCMS_Banner.php. Manipulation of input can lead to SQL injection, remotely exploitable.
- CVE-2026-108813Medium
SQL injection vulnerability in SEMCMS (up to 5.0) in SEMCMS_Download.php. Manipulation of input leads to SQL injection, remotely exploitable.
- CVE-2026-96739Medium
A vulnerability was found in SEMCMS up to version 4.2 in the file /Edit/php/upload_json.php. Manipulation of the imgFile argument causes cross site scripting. The attack may be initiated remotely and the exploit has been published.
- CVE-2026-39170Medium
SemCms 5.0 is vulnerable to Cross-Site Request Forgery (CSRF) via a crafted POST request to /admin/semcms_user.php.
- CVE-2026-39169High
SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.
- CVE-2025-51660Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51659Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51658Medium
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter in SEMCMS_InquiryView.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51657Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Link.php. Attackers can manipulate this parameter to execute unauthorized database queries.
Original NVD description (English source)
A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS