EUVD-2026-97285
GHSA-8rg8-qfgh-x9mp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed SEMCMS admin endpoint
-
ExploitSend request to SEMCMS_User.php?Class=Deleted&CF=user
-
ExecutionAuthorization check bypassed
-
ImpactArbitrary user accounts deleted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the SEMCMS administrative interface, specifically the /admin/SEMCMS_User.php endpoint with parameters Class=Deleted&CF=user, on any SEMCMS version up to and including 5.0. Per the CVSS vector (PR:N/UI:N/AC:L/AT:N) no authentication, no user interaction, and no special configuration are needed - the improper-authorization flaw (CWE-285) means the user-deletion action executes without the authorization check that should gate it. The primary limiting factor is exposure: the admin path must be internet-reachable (or reachable from the attacker's network position) for remote exploitation, and the affected product's niche deployment limits the realistic target population. Impact is confined to deletion of user accounts (integrity/availability), not data exfiltration or code execution. |
| Impact | This is a genuine but moderate-priority issue, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L) scores 5.5 (MEDIUM) and is internally consistent with the description: a remote, low-complexity, unauthenticated request against /admin/SEMCMS_User.php triggers an improper-authorization flaw (CWE-285) that permits deletion of arbitrary user accounts. Integrity and availability impacts are rated Low and confidentiality is None, which fits account deletion (data loss / denial of access to those accounts) rather than data theft or full system compromise. The vector carries E:P (Proof-of-Concept), corroborated by a publicly available GitHub exploit, so publicly available exploit code exists - but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation. The signals are therefore consistent rather than conflicting: easy to exploit (PR:N/AC:L + public POC) but limited blast radius (medium severity, user-deletion only, niche product). Treat as a real-but-contained risk. NOTE: This is attributed to CVE-2026-108812 with a 2026 identifier - if your analysis date predates assignment confirmation, verify the CVE ID and that the vendor (unresponsive per the report) has no patch. |
| Exploit ScenarioDerived | A remote attacker, without authenticating, sends a crafted request to /admin/SEMCMS_User.php?Class=Deleted&CF=user and deletes arbitrary user accounts because the endpoint fails to enforce proper authorization. A public proof-of-concept exists on GitHub (ants01/semcmsPHP-V5.0), so the technique is already documented and low-effort to reproduce against any exposed SEMCMS ≤5.0 instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Unauthenticated remote attackers can delete arbitrary user accounts in SEMCMS through version 5.0 by hitting the administrative endpoint /admin/SEMCMS_User.php with the parameters Class=Deleted&CF=user, which performs the deletion without enforcing the authorization check that should gate it (CWE-285). Exploitation requires only network reachability to the admin interface - no credentials, no user interaction, and no special configuration - and publicly available exploit code exists (a GitHub proof-of-concept targeting SEMCMS PHP V5.0), though there is no evidence of confirmed active exploitation in the wild. Impact is limited to integrity and availability of user records (account deletion), with no confidentiality, code-execution, or lateral-movement component, and the vendor did not respond to disclosure, so no official fix has been identified.
RemediationAI
No vendor-released patch has been identified at the time of analysis - the SEMCMS maintainers were contacted early about the disclosure but did not respond, so there is no official fixed version to upgrade to and no vendor advisory to cite beyond the VulDB records at https://vuldb.com/vuln/416589 (with CTI detail at https://vuldb.com/vuln/416589/cti) and the public proof-of-concept at https://github.com/ants01/semcmsPHP-V5.0-There-is-an-unauthorized-deletion-of-arbitrary-users. Until a fix ships, the most effective control is to remove the exposure: block internet and untrusted-network access to the /admin/ path (especially /admin/SEMCMS_User.php) via web-server ACLs, reverse-proxy rules, or firewall policy, and restrict administrative access to a management VPN or allow-listed source addresses, accepting that this also blocks legitimate remote administration. If the admin interface must remain reachable, place it behind authentication at the web-server or reverse-proxy layer (HTTP Basic, client certificates, or an SSO gateway) so the request never reaches the unprotected script, and add a WAF rule that rejects requests to /admin/SEMCMS_User.php containing Class=Deleted with CF=user - noting that signature-based blocking is bypassable via parameter encoding and should be treated as defense in depth only. Additional compensating measures include temporarily disabling the user-management module, monitoring web logs for GET/POST requests to /admin/SEMCMS_User.php with Deleted-class parameters as an indicator of attempted abuse, and maintaining offline backups of user records so accounts removed through this flaw can be restored, since the impact is limited to integrity and availability of user data rather than data exfiltration or code execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SEMCMS is a PHP-based content management system, and the vulnerable component is its administrative user-management script /admin/SEMCMS_User.php, which is reachable over HTTP(S). The root cause is CWE-285 (Improper Authorization): the script routes on the Class and CF request parameters and, for the Deleted/CF=user path, carries out the user-deletion action without verifying that the caller holds an administrative session or the privileges required to remove accounts. Because the missing control is an authorization check rather than an input-validation or memory-safety defect, exploitation is a matter of simply invoking the endpoint with the correct parameters - no crafted payload, memory corruption, or chained bug is needed. The CVSS vector identifies the weakness as network-exploitable with low attack complexity, no privileges required, and no user interaction, and the CPE data (cpe:2.3:a:n/a:semcms:*:*:*:*:*:*:*:*) indicates that all released SEMCMS versions up to and including 5.0 are presumed affected, since the vendor assigned no version-specific scope.
Know when Semcms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated request (AV:N/AC:L/PR:N/UI:N) exploits a missing authorization check; deleting user accounts yields Low integrity and availability impact and no confidentiality disclosure.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS_User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php. Rated critical severity (CVSS 9.8), this vulnerabilit
SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obt
SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive info
Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php. Rated
SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php. Rated critical severity (CVSS 9.8), this vulnerability is
A CSRF issue was discovered in SEMCMS 3.4 via the admin/SEMCMS_User.php?Class=add&CF=user URI. Rated high severity (CVSS
SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php. Rated
A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID param
SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID paramet
SEMCMS 3.9 is vulnerable to SQL Injection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
SEMCMS 4.8 is vulnerable to Incorrect Access Control. Rated high severity (CVSS 7.2), this vulnerability is remotely exp
Exploit-DB