Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
65 results · page 1 of 2
Oct 12, 2026A flaw has been found in SEMCMS up to 5.0.CVE-2026-108814 · Other software · reported by VulDBLow 2.1
A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A vulnerability was detected in SEMCMS up to 5.0.CVE-2026-108813 · Other software · reported by VulDBLow 2.1
A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026A security vulnerability has been detected in SEMCMS up to 5.0.CVE-2026-108812 · Other software · reported by VulDBMedium 5.5
A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026A flaw has been found in SEMCMS up to 4.2.CVE-2026-96739 · Other software · reported by VulDBLow 2.1
A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.CVE-2026-39170 · Other software · reported by MITREMedium 6.3
SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.CVE-2026-39169 · Other software · reported by MITREHigh 7.5
SEMCMS 5.0 is vulnerable to unauthorized access in SEMCMS_copy.php.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jan 28, 2026A security vulnerability has been detected in SEMCMS 5.0.CVE-2026-1552 · Other software · Sem-cms · reported by VulDBLow 2.1
A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMS_Info.php. The manipulation of the argument searchml leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php.CVE-2025-51660 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php.CVE-2025-51659 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php.CVE-2025-51658 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php.CVE-2025-51657 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php.CVE-2025-51656 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php.CVE-2025-51655 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php.CVE-2025-51654 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php.CVE-2025-51653 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php.CVE-2025-51652 · Other software · Sem-cms · reported by MITREMedium 5.4
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.CVE-2025-25686 · Other software · Sem-cms · reported by MITRECritical 9.8
semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025A vulnerability has been found in SEMCMS up to 4.8 and classified as critical.CVE-2024-13193 · Other software · Sem-cms · reported by VulDBMedium 5.3
A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMS_Images.php of the component Image Library Management Page. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page.CVE-2024-53502 · Other software · Sem-cms · reported by MITRELow 3.8
Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2024SemCms v4.8 was discovered to contain a SQL injection vulnerability.CVE-2024-52725 · Other software · Sem-cms · reported by MITREMedium 4.9
SemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to execute arbitrary code via the ldgid parameter in the SEMCMS_SeoAndTag.php component.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2024SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.CVE-2024-46103 · Other software · sem-cms · reported by MITRECritical 9.8
SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the lgid parameter in Download.php.CVE-2024-36801 · Other software · Sem-cms · reported by MITREMedium 5.9
A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the lgid parameter in Download.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php.CVE-2024-36800 · Other software · sem-cms · reported by MITREHigh 7.5
A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024A vulnerability has been found in SEMCMS up to 4.8 and classified as critical.CVE-2024-4595 · Other software · sem-cms · reported by VulDBMedium 6.3
A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is the function locate of the file function.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-263317 was assigned to this vulnerability.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script.CVE-2024-32409 · Other software · sem-cms · reported by MITREHigh 7.1
An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2024SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the ID parameter in the SEMCMS_User.php component.CVE-2024-30938 · Other software · sem-cms · reported by MITRECritical 9.8
SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the ID parameter in the SEMCMS_User.php component.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the uploadCVE-2024-31012 · Other software · sem-cms · reported by MITRECritical 9.8
An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the upload.php file.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.CVE-2024-31010 · Other software · sem-cms · reported by MITREHigh 7.5
SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php.CVE-2024-31009 · Other software · sem-cms · reported by MITREMedium 6.5
SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2024SEMCMS 4.8 is vulnerable to Incorrect Access Control.CVE-2024-28405 · Other software · sem-cms · reported by MITREHigh 7.2
SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page because authentication function is called from there, users gain admin privileges.
- Product
- semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2024SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMS_Menu.php componenCVE-2024-25422 · Other software · Sem-cms · reported by MITRECritical 9.8
SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMS_Menu.php component.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php.CVE-2023-48864 · Other software · Sem-cms · reported by MITREHigh 7.5
SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php.CVE-2023-50563 · Other software · Sem-cms · reported by MITRECritical 9.8
Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023SEMCMS 3.9 is vulnerable to SQL Injection.CVE-2023-48863 · Other software · Sem-cms · reported by MITREHigh 7.5
SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engine for execution, and sends some attack codes as commands or query statements to the interpreter. These malicious data can deceive the interpreter, so as to execute unplanned commands or unauthorized access to data.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php.CVE-2020-23564 · Other software · Sem-cms · reported by MITREHigh 7.2
File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2023SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.CVE-2023-37647 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2023File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges.CVE-2020-18432 · Other software · Sem-cms · reported by MITRECritical 9.8
File Upload vulnerability in SEMCMS PHP 3.7 allows remote attackers to upload arbitrary files and gain escalated privileges.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php.CVE-2023-31707 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php.CVE-2023-30090 · Other software · Sem-cms · reported by MITRECritical 9.8
Semcms Shop v4.2 was discovered to contain an arbitrary file uplaod vulnerability via the component SEMCMS_Upfile.php. This vulnerability allows attackers to execute arbitrary code via uploading a crafted PHP file.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php.CVE-2021-38733 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php.CVE-2021-38732 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php.CVE-2021-38731 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php.CVE-2021-38730 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.CVE-2021-38729 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.CVE-2021-38728 · Other software · Sem-cms · reported by MITREMedium 6.1
SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.CVE-2021-38217 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php.CVE-2021-38737 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php.CVE-2021-38736 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2022SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php.CVE-2021-38734 · Other software · Sem-cms · reported by MITRECritical 9.8
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php.
- Product
- Semcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022A vulnerability classified as critical has been found in SEMCMS.CVE-2022-2726 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in SEMCMS. This affects an unknown part of the file Ant_Check.php. The manipulation of the argument DID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205839.
- Product
- SEMCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.