CVE-2023-53975

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
thedigicraft	Atom CMS	2.0

References

https://github.com/thedigicraft/Atom.CMSProduct
https://www.exploit-db.com/exploits/51086Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/atom-cms-unauthenticated-sql-injection-via-admin-index-pageThird Party Advisory

Timeline

Published: Dec 22, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-539765.4myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administ CVE-2023-539775.4myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrat CVE-2023-539785.4myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administr CVE-2023-539798.8MyBB 1.8.32 contains a chained vulnerability that allows authenticated administrators to bypass avatar upload restrictions and execute arbit CVE-2023-53985.9Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. See Honeywell Security CVE-2023-539809.8ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extens CVE-2023-539817.2PhotoShow 3.0 contains a remote code execution vulnerability that allows authenticated administrators to inject malicious commands through t CVE-2023-539827.5PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the storage module (categ=storage) of the opac_css/ajax.php endpoint CVE-2023-539839.8Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Atta CVE-2023-539848.4Clevo HotKey Clipboard 2.1.0.6 contains an unquoted service path vulnerability in the HKClipSvc service that allows local non-privileged use CVE-2023-539856.1Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject maliciou CVE-2023-539868.6In the Linux kernel, the following vulnerability has been resolved: mips: bmips: BCM6358: disable RAC flush for TP1 RAC flush causes kerne