Sem-cms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-25686 semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.Critical 9.8 · Mar 27, 2025
• CVE-2024-46103 SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.Critical 9.8 · Sep 20, 2024
• CVE-2024-36800 A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php.High 7.5 · Jun 4, 2024
• CVE-2024-32409 An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script.High 7.1 · Apr 19, 2024
• CVE-2024-30938 SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the ID parameter in the SEMCMS_User.php component.Critical 9.8 · Apr 18, 2024
• CVE-2024-31012 An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the uploadCritical 9.8 · Apr 3, 2024
• CVE-2024-31010 SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.High 7.5 · Apr 3, 2024
• CVE-2024-28405 SEMCMS 4.8 is vulnerable to Incorrect Access Control.High 7.2 · Mar 29, 2024
• CVE-2024-25422 SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMS_Menu.php componenCritical 9.8 · Feb 28, 2024
• CVE-2023-48864 SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php.High 7.5 · Jan 10, 2024
• CVE-2023-50563 Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php.Critical 9.8 · Dec 14, 2023
• CVE-2023-48863 SEMCMS 3.9 is vulnerable to SQL Injection.High 7.5 · Dec 4, 2023
• CVE-2020-23564 File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php.High 7.2 · Aug 4, 2023
• CVE-2023-37647 SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.Critical 9.8 · Jul 31, 2023
• CVE-2020-18432 File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges.Critical 9.8 · Jun 29, 2023
• CVE-2023-31707 SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php.Critical 9.8 · May 19, 2023
• CVE-2023-30090 Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php.Critical 9.8 · May 4, 2023
• CVE-2021-38733 SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php.Critical 9.8 · Oct 28, 2022
• CVE-2021-38732 SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php.Critical 9.8 · Oct 28, 2022
• CVE-2021-38731 SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php.Critical 9.8 · Oct 28, 2022
• CVE-2021-38730 SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php.Critical 9.8 · Oct 28, 2022
• CVE-2021-38729 SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.Critical 9.8 · Oct 28, 2022
• CVE-2021-38217 SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.Critical 9.8 · Oct 28, 2022
• CVE-2021-38737 SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php.Critical 9.8 · Oct 28, 2022
• CVE-2021-38736 SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php.Critical 9.8 · Oct 28, 2022