This vulnerability (CVE-2026-5801) in SEM-PMP arises from improper neutralization of special elements used in SQL commands, classified under CWE-89 (SQL injection). It enables an attacker to execute commands via SQL injection, potentially leading to full compromise of the affected system. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting network exploitable, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The affected versions include all versions through 23042026. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the system via SQL injection, resulting in complete compromise of confidentiality, integrity, and availability of the affected SEM-PMP installations. This can lead to unauthorized data access, data modification, and denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the SEM-PMP application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the application to untrusted networks.