CVE-2026-108814
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can execute arbitrary SQL queries against the backend database, potentially reading or tampering with application data. Exploitation requires network access and low-privileged user credentials.
Root cause
SEMCMS_Banner.php fails to sanitize or parameterize user-supplied input before passing it into an SQL query.
Affected systems
SEMCMS up to 5.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patched version is available. Restrict network access to SEMCMS or block direct HTTP requests to SEMCMS_Banner.php via web server rules (such as in Nginx or Apache) until an upstream patch or code fix is applied.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.