semcms vulnerabilities and fixes

Recent CVEs affecting semcms, with upgrade or downgrade steps. 23 tracked.

semcms has 23 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-01-29. Highest priority: CVE-2024-31012 (score 61/100).

• CVE-2024-32409 HIGH 7.1 DOWNGRADE An issue in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code via a crafted script.
• CVE-2025-51660 MEDIUM 5.4 UPGRADE SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.
• CVE-2025-51659 MEDIUM 5.4 UPGRADE SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.ph
• CVE-2025-51658 MEDIUM 5.4 UPGRADE SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView
• CVE-2025-51657 MEDIUM 5.4 UPGRADE SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php.
• CVE-2025-51656 MEDIUM 5.4 UPGRADE SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php.
• CVE-2025-51655 MEDIUM 5.4 UPGRADE SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.p
• CVE-2025-51654 MEDIUM 5.4 UPGRADE SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocatego
• CVE-2025-51653 MEDIUM 5.4 UPGRADE SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php.
• CVE-2025-51652 MEDIUM 5.4 UPGRADE SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories
• CVE-2024-52725 MEDIUM 4.9 DOWNGRADE SemCms v4.8 was discovered to contain a SQL injection vulnerability
• CVE-2026-1552 MEDIUM 6.3 DOWNGRADE A security vulnerability has been detected in SEMCMS 5.0
• CVE-2025-25686 CRITICAL 9.8 UPGRADE semcms <=5.0 is vulnerable to SQL Injection in SEMCMS_Fuction.php.
• CVE-2024-53502 LOW 3.8 DOWNGRADE Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMS_SeoAndTag.php page.
• CVE-2024-4595 MEDIUM 6.3 UPGRADE A vulnerability has been found in SEMCMS up to 4.8 and classified as critical
• CVE-2024-46103 CRITICAL 9.8 DOWNGRADE SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.
• CVE-2024-31012 CRITICAL 9.8 DOWNGRADE An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privilege
• CVE-2024-31010 HIGH 7.5 DOWNGRADE SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the
• CVE-2024-31009 MEDIUM 6.5 DOWNGRADE SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid
• CVE-2024-30938 CRITICAL 9.8 DOWNGRADE SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the I
• CVE-2024-28405 HIGH 7.2 DOWNGRADE SEMCMS 4.8 is vulnerable to Incorrect Access Control
• CVE-2024-25422 CRITICAL 9.8 DOWNGRADE SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sens
• CVE-2024-13193 MEDIUM 6.3 UPGRADE A vulnerability has been found in SEMCMS up to 4.8 and classified as critical

FAQ

How do I fix semcms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is semcms being exploited right now?

None of the tracked semcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which semcms CVE should I patch first?

CVE-2024-31012 currently ranks highest (61/100): An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privilege.

RSS feed for semcms · ← Back to latest CVEs