CVE-2025-51652 identifies a SQL injection vulnerability in SemCms v5.0, specifically through the pid parameter in SEMCMS_Categories.php. This vulnerability allows an attacker with network access and low privileges to perform unauthorized SQL queries, potentially leading to limited confidentiality and integrity impacts. The vulnerability does not require user interaction and does not affect availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited impact on confidentiality and integrity.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure or modification of data. There is no impact on system availability reported. The confidentiality and integrity impacts are limited but present.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should consider restricting access to the affected component and validate or sanitize inputs to the pid parameter as a temporary mitigation.