CVE-2023-53923

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Dec 17, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-539248.8UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .p CVE-2023-539256.1UliCMS 2023.1 contains a stored cross-site scripting vulnerability that allows attackers to upload malicious SVG files with embedded JavaScr CVE-2023-539269.8PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate databa CVE-2023-539275.4PHPJabbers Simple CMS 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scrip CVE-2023-539286.1PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to upload malicious SVG fil CVE-2023-539298.0phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names CVE-2023-53937.4Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code e CVE-2023-539307.5ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files CVE-2023-539316.1Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allows attackers to injec CVE-2023-539325.4Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through b CVE-2023-539338.8Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .pha CVE-2023-539347.5A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResou