CVE-2026-39170
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
SemCms 5.0 is vulnerable to Cross-Site Request Forgery (CSRF) via a crafted POST request to /admin/semcms_user.php.
Risk Assessment
An attacker can trick a logged-in administrator into performing unwanted actions, such as changing user permissions, without their knowledge.
Recommendation
Implement CSRF protection mechanisms, such as anti-CSRF tokens, in SemCms admin forms.
Other vulnerabilities in SemCms
See all- CVE-2023-37647Critical
SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the 'id' parameter in /Ant_Suxin.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2026-39169High
SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.
- CVE-2025-51660Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51659Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51658Medium
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter in SEMCMS_InquiryView.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51657Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Link.php. Attackers can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51656Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Link.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51655Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Quanxian.php. Attackers can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51654Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_Infocategories.php. Attackers can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51653Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the pid parameter in SEMCMS_ct.php. Attackers can exploit this flaw to execute unauthorized database queries.
Original NVD description (English source)
SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.