CVE-2019-11518

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An issue was discovered in SEMCMS 3.8. SEMCMS_Inquiry.php allows AID[] SQL Injection because the class.phpmailer.php inject_check_sql protection mechanism is incomplete.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/kikulo/DebugOpen/blob/master/SEMCMS3.8/main.mdExploit, Third Party Advisory
https://github.com/kikulo/DebugOpen/blob/master/SEMCMS3.8/main.mdExploit, Third Party Advisory

Timeline

Published: Apr 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-115194.9Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Ed CVE-2019-11528.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker CVE-2019-115218.1OX App Suite 7.10.1 allows Content Spoofing.CVE-2019-115225.4OX App Suite 7.10.0 to 7.10.2 allows XSS.CVE-2019-115239.8Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers c CVE-2019-115269.8An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injectio CVE-2019-115278.8An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url paramet CVE-2019-115287.5An issue was discovered in Softing uaGate SI 1.60.01. A system default path for executables is user writable.CVE-2019-11535.5An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attack CVE-2019-115336.1Cross-site scripting (XSS) vulnerability in ProjectSend before r1070 allows remote attackers to inject arbitrary web script or HTML.CVE-2019-115359.8Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote comm CVE-2019-115369.8Kalki Kalkitech SYNC3000 Substation DCU GPC v2.22.6, 2.23.0, 2.24.0, 3.0.0, 3.1.0, 3.1.16, 3.2.3, 3.2.6, 3.5.0, 3.6.0, and 3.6.1, when WebHM