CVE-2026-1552: SEMCMS SEMCMS_Info.php sql injection

Published Jan 29, 2026

Updated

A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMSInfo.php. The manipulation of the argument searchml leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

SEMCMS SEMCMS

Sem-cms Semcms=5.0

Event History

Jan 29, 2026

CVE Published

via MITRE·12:02 AM

Data Sourced

via MITRE·12:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1552?

CVE-2026-1552 is considered a critical SQL injection vulnerability due to its potential for remote exploitation.

How do I fix CVE-2026-1552?

To fix CVE-2026-1552, sanitize user input in the 'searchml' argument and implement prepared statements to prevent SQL injection.

Which software versions are affected by CVE-2026-1552?

CVE-2026-1552 affects all versions of SEMCMS 5.0.

What impact does CVE-2026-1552 have on my system?

CVE-2026-1552 allows attackers to perform unauthorized SQL queries, potentially compromising the database and exposing sensitive data.

Is there a way to mitigate CVE-2026-1552 if an immediate fix is not possible?

Temporary mitigation for CVE-2026-1552 includes restricting access to the SEMCMS_Info.php file and monitoring database activity for suspicious queries.