CVE-2026-108813: SEMCMS SEMCMS_Download.php sql injection
A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMSDownload.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be initiated remotely, but it requires low-level privileges. No user interaction is required.
Which installations should be treated as potentially affected?
SEMCMS versions up to 5.0 are identified as affected. The available information does not state whether a default installation exposes the vulnerable functionality.
Is public exploit code available?
Yes. The exploit is reported as public, which increases the likelihood that the issue may be used in attacks.
What should teams do if a patch is not available?
The available information does not provide a workaround or mitigation. Restrict access to SEMCMS to trusted users and networks where possible, since exploitation requires privileges and can be performed remotely.
How can an organization determine whether it is affected?
Confirm whether it uses SEMCMS version 5.0 or earlier and assess access to the SEMCMS_Download.php functionality. The disclosure does not identify the affected parameter or provide detection indicators.