This vulnerability in SEMCMS up to version 4.2 allows remote attackers to perform cross-site scripting via the imgFile parameter in the /Edit/php/upload_json.php endpoint of the KindEditor Upload Interface. The flaw enables injection of malicious scripts that execute in the context of the victim's browser. Exploit code has been published, but there is no indication of active exploitation in the wild. The vendor was notified but did not provide a response or patch.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to session hijacking, defacement, or other client-side attacks. However, the attack requires user interaction and does not escalate privileges or compromise the server directly.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's channels for updates. In the meantime, applying web application firewall (WAF) rules to detect and block malicious payloads targeting the imgFile parameter may help mitigate risk. Avoiding use of the affected functionality or restricting access to trusted users could also reduce exposure.