CVE-2026-108813
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can read or tamper with the database via SQL injection. Exploits are publicly available.
Root cause
Improper input neutralization allows parameter manipulation to inject SQL queries into SEMCMS_Download.php.
Affected systems
SEMCMS up to 5.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patch exists as the vendor did not respond. Block or restrict access to SEMCMS_Download.php at your web server or reverse proxy, or take the application offline.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.