CVE-2023-53929

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

phpMyFAQ 3.1.12 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into their profile names. Attackers can modify their user profile name with a payload like 'calc|a!z|' to trigger code execution when an administrator exports user data as a CSV file.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

No affected versions have been published.

Timeline

Published
Dec 17, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-53937.4Server receiving a malformed message that causes a disconnect to a hostname may causing a stack overflow resulting in possible remote code eCVE-2023-539307.5ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private filesCVE-2023-539316.1Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allows attackers to injecCVE-2023-539325.4Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through bCVE-2023-539338.8Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phaCVE-2023-539347.5A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResouCVE-2023-539355.4WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter iCVE-2023-539364.8Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scrCVE-2023-539377.8Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dCVE-2023-539385.4RockMongo 1.1.7 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through multiple unenCVE-2023-539395.4TinyWebGallery v2.5 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts thrCVE-2023-53947.4Server receiving a malformed message that where the GCL message hostname may be too large which may cause a stack overflow; resulting in pos
CVE-2023-53929: High severity, CVSS 8.0 | Vulnix