Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-108814: SEMCMS up to version 5.0 allows remote data theft via banner page
CVE-2026-108814 · published 6 days ago
Summary
The SEMCMS content system (versions up to 5.0) has a weakness in the SEMCMS_Banner.php page that lets an attacker send specially crafted data to run unauthorized database commands. This can be done over the internet and could expose or change stored information. Apply the vendor’s patch or update to a newer, fixed version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| – | semcms | 5.0 |
Original advisory text
SEMCMS SEMCMS_Banner.php sql injection
A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published12 Oct 2026
Updated15 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta