CVE-2026-1552: SEMCMS 5.0 SQL Injection via searchml Parameter in SEMCMS_Info.php
A SQL injection vulnerability (CWE-89) has been reported in SEMCMS 5.0, involving the searchml argument of /SEMCMS_Info.php. According to the NVD-assigned CVSS 3.1 score of 9.8, the flaw can be exploited remotely without privileges or user interaction. The record states that an exploit has been publicly disclosed, but no confirmed exploitation appears in the sources consulted and the vendor did not respond to early disclosure.
Overview
CVE-2026-1552 is a SQL injection weakness (CWE-89) in SEMCMS version 5.0, located in the /SEMCMS_Info.php file through the searchml argument. The record was published on 2026-01-29 and analyzed by the CNA VulDB. The affected code location is described as unknown in detail.
Impact
- The sources describe the flaw as allowing SQL injection, which can typically expose or alter data stored in the application database.
- The NVD CVSS 3.1 vector indicates network attack vector, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact.
- Actual consequences depend on the deployment and on the database permissions in use, which the record does not describe.
Affected products and versions
- Product: Sem-cms Semcms
- Affected version listed: version 5.0
- No other affected versions, ranges or fixed versions are listed in the consulted record.
Exploitation status
The KEV catalog does not list this CVE, so no confirmed active exploitation is stated by CISA in the sources consulted. The record notes that an exploit has been publicly disclosed and may be used, referencing a public issue tracker entry. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Review the vendor or project channels for an updated release; the record does not name a fixed version.
- The only listed fix entry is of type mitigation and points to a third-party issue tracker. Review it carefully before applying any guidance.
- Restrict network access to the affected application where possible, and limit exposure of the SEMCMS_Info.php endpoint to trusted users.
- Apply the principle of least privilege to the database account used by the application.
Detection guidance
- Review web server and application logs for unusual or malformed values in the searchml parameter targeting SEMCMS_Info.php.
- Monitor database error messages and unexpected query patterns originating from the web application.
- Consider web application firewall rules that alert on SQL metacharacters in this parameter, tuned to avoid false positives.
Limitations of the available information
- The record does not provide a fixed version or confirmed vendor patch; the vendor did not respond to disclosure.
- Scores from other providers (CNA VulDB CVSS 4.0 of 2.1, CVSS 3.1 of 6.3, CVSS 2.0 of 6.5) differ from the NVD score and should be read alongside it.
- No EPSS, SSVC or KEV data is available for this CVE.
- The exact vulnerable code location is described as unknown.
Frequently asked questions
What is the core issue in CVE-2026-1552?
The searchml argument of /SEMCMS_Info.php in SEMCMS 5.0 is reported to be vulnerable to SQL injection, classified as CWE-89.
Is this CVE known to be actively exploited?
CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The record says a public exploit has been disclosed.
Is a fixed version available?
The record does not name a fixed version. The only listed fix entry is a mitigation reference on a third-party issue tracker.
What should defenders do now?
Restrict access to the affected endpoint, apply least privilege to the database account, monitor logs for abnormal searchml values, and check vendor channels for an update.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.