CVE-2026-39170
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
SemCms 5.0 is vulnerable to Cross-Site Request Forgery (CSRF) via a crafted POST request to /admin/semcms_user.php.
Risk Assessment
An attacker can trick a logged-in administrator into performing unwanted actions, such as changing user permissions, without their knowledge.
Recommendation
Implement CSRF protection mechanisms, such as anti-CSRF tokens, in SemCms admin forms.
Other vulnerabilities in SemCms
See all- CVE-2023-37647Critical
SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the 'id' parameter in /Ant_Suxin.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2026-108814Medium
SQL injection vulnerability in SEMCMS (up to 5.0) in SEMCMS_Banner.php. Manipulation of input can lead to SQL injection, remotely exploitable.
- CVE-2026-108813Medium
SQL injection vulnerability in SEMCMS (up to 5.0) in SEMCMS_Download.php. Manipulation of input leads to SQL injection, remotely exploitable.
- CVE-2026-108812Medium
Improper authorization vulnerability in SEMCMS (up to 5.0) in /admin/SEMCMS_User.php?Class=Deleted&CF=user. Manipulation leads to improper authorization, remotely exploitable.
- CVE-2026-96739Medium
A vulnerability was found in SEMCMS up to version 4.2 in the file /Edit/php/upload_json.php. Manipulation of the imgFile argument causes cross site scripting. The attack may be initiated remotely and the exploit has been published.
- CVE-2026-39169High
SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.
- CVE-2025-51660Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51659Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the ID parameter in SEMCMS_Products.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51658Medium
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter in SEMCMS_InquiryView.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2025-51657Medium
A SQL injection vulnerability was discovered in SemCms v5.0 via the lgid parameter in SEMCMS_Link.php. Attackers can manipulate this parameter to execute unauthorized database queries.
Original NVD description (English source)
SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS