CVE-2023-53949

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service. Attackers can exploit full write permissions in the BIN directory to replace the service executable and gain elevated system access.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

VendorProductVersions
AspemailAspEmail<= 5.6.0.2

References

Timeline

Published
Dec 19, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-53958.1Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote codCVE-2023-539509.8InnovaStudio WYSIWYG Editor 5.4 contains an unrestricted file upload vulnerability that allows attackers to bypass file extension restrictioCVE-2023-539519.8Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key implementation. AttackCVE-2023-539528.8Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar CVE-2023-539535.4WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when crCVE-2023-539546.2ActFax 10.10 contains an unquoted service path vulnerability that allows local attackers to potentially escalate privileges by exploiting thCVE-2023-539559.8SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization CVE-2023-539568.8Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files througCVE-2023-539578.8Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malicious exploitation. ACVE-2023-539587.5LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers duriCVE-2023-539599.8FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShapCVE-2023-53967.4Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code exe
CVE-2023-53949: High severity, CVSS 8.4 | Vulnix