SEMCMS EUVD-2026-85737

Requires the SEMCMS KindEditor upload feature to be reachable, specifically the /Edit/php/upload_json.php handler processing the imgFile argument. Exploitation is remote and unauthenticated (PR:N) but requires user interaction (UI:P) - a victim must open/trigger the attacker-supplied request, so this is not a fully automatic drive-by. Impact is limited to client-side script execution (integrity VI:L only); there is no direct server-side confidentiality or availability impact. Realistic risk is bounded by the need to deliver the payload to a CMS user and by the niche deployment of SEMCMS (versions up to 4.2).

This is a low-to-moderate real-world risk despite a public exploit. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P/VC:N/VI:L/VA:N, base 5.3) describes a cross-site scripting flaw in the KindEditor upload interface reachable over the network without authentication, but requiring user interaction (UI:P) and delivering only limited integrity impact (VI:L) with no confidentiality or availability impact - consistent with client-side script injection rather than server compromise. The E:P exploit-maturity flag plus the 'exploit has been published' text and the GitHub reference confirm publicly available exploit code exists, but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation in the provided data. Signals are internally consistent (network XSS needing a victim to interact), so no metric conflicts to flag; the main caveat is that VulDB is the sole originating source and the vendor did not respond, so affected-version and impact detail are single-sourced. Overall this is a typical published-POC XSS in a niche CMS - worth patching where SEMCMS is deployed, but not a widespread-exploitation priority.

An attacker crafts a malicious link or request targeting /Edit/php/upload_json.php with a poisoned imgFile argument and lures an authenticated CMS operator or site visitor into triggering it, causing attacker-controlled JavaScript to execute in the victim's browser session in the CMS context. Public exploit code is already available (GitHub issue and VulDB entry), lowering the barrier to reproduction; because user interaction is required, the attacker must deliver the crafted request to a victim.