What is the CVSS score of CVE-2026-39170?

CVE-2026-39170 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

SemCms CVE-2026-39170

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-09 mitre

PHP CSRF N A

6.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:41 vuln.today

CVSS changed

Jun 09, 2026 - 21:22 NVD

6.3 (MEDIUM)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

SemCms 5.0 is vulnerable to Cross Site Request Forgery (CSRF) via crafted POST request to /admin/semcms_user.php.

AnalysisAI

Cross-site request forgery in SemCms 5.0 allows a remote attacker to perform unauthorized actions against the admin user management endpoint at /admin/semcms_user.php by tricking an authenticated administrator into triggering a crafted POST request. The affected product is a PHP-based CMS and the vulnerability stems from a missing or bypassable CSRF token on a privileged administrative function. Publicly available exploit code exists per SSVC data, though the vulnerability has not been added to the CISA KEV catalog and is not confirmed as actively exploited in the wild.

Technical ContextAI

SemCms 5.0 is a PHP-based content management system. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a class of flaws where the server-side application fails to verify that a legitimate, authenticated user intentionally submitted a state-changing request. The specific target endpoint is /admin/semcms_user.php, which handles user management functions in the administrative panel. Because the application does not enforce anti-CSRF mechanisms (such as synchronizer tokens, SameSite cookie attributes, or origin header validation) on this endpoint, an attacker can craft a malicious POST request that the victim's browser will send with valid session credentials. The CPE data provided (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is non-specific and does not further constrain affected product scope beyond the CVE description itself.

RemediationAI

No vendor-released patch has been identified at time of analysis. The sole reference is a researcher-published GitHub Gist, and no official SemCms advisory or tagged release addressing this vulnerability was found. As an immediate compensating control, administrators should implement CSRF token validation on all state-changing POST requests to /admin/semcms_user.php and other admin endpoints - note this requires code modification and carries a risk of breaking existing integrations if done incorrectly. Additionally, restricting access to the /admin/ directory by IP allowlist (e.g., via web server ACL or firewall rule) would substantially reduce attack surface, with the trade-off of limiting legitimate remote administration. Setting the session cookie's SameSite attribute to Strict or Lax provides browser-level CSRF mitigation for modern clients but does not protect users on older browsers. Administrators should monitor the reference Gist at https://gist.github.com/ql288470-pixel/41e01787357416458212dbbfd06c6d73 and the SemCms project for an official patch release.