CVE-2024-31012

CRITICAL

SEMCMS 4.8 - Unauthenticated Arbitrary File Upload via upload.php

Title source: llm
STIX 2.1

Description

An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the upload.php file.

References (1)

Core 1

Scores

CVSS v3 9.8
EPSS 0.0116
EPSS Percentile 62.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
sem-cms/semcms 4.8
Published Apr 03, 2024
Tracked Since Feb 18, 2026