CVE-2020-18081

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext through a SQL query.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/cve-vul/vul/blob/master/SEMCMS/backstage_access_control.mdExploit, Third Party Advisory
https://github.com/cve-vul/vul/blob/master/SEMCMS/backstage_access_control.mdExploit, Third Party Advisory

Timeline

Published: Dec 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-180846.1Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field o CVE-2020-18094.6HUAWEI Mate 10 smartphones with versions earlier than 10.0.0.143(C00E143R2P4) have an information disclosure vulnerability. The attacker cou CVE-2020-18105.3There is a weak algorithm vulnerability in some Huawei products. The affected products use the RSA algorithm in the SSL key exchange algorit CVE-2020-181026.1Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fi CVE-2020-181069.8The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection.CVE-2020-18118.8GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low pe CVE-2020-181149.8An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format CVE-2020-181168.8A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection.CVE-2020-18127.8HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly v CVE-2020-181218.8A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell.CVE-2020-181236.5A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts.CVE-2020-181245.7A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords.