CVE-2023-28854

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function such as `env_patchsample230330.php` to env.php.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
paijp	nophp	< 0.0.1

References

https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aaPatch
https://github.com/paijp/nophp/releases/tag/v0.0.1Release Notes
https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwmVendor Advisory
https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aaPatch
https://github.com/paijp/nophp/releases/tag/v0.0.1Release Notes
https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwmVendor Advisory

Timeline

Published: Apr 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-288556.5Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to versions 1.13.1 and 1.20.4, lack of access cont CVE-2023-288566.5Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an inval CVE-2023-288577.5Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on c CVE-2023-288583.7redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to CVE-2023-288596.5redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and can CVE-2023-28864.3Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue CVE-2023-288629.8An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling d CVE-2023-288639.1AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.CVE-2023-288645.5Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporar CVE-2023-288656.6Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory conte CVE-2023-288665.3In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to CVE-2023-288677.5In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versio