CVE-2023-6654

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	PHPEMS	6.x; 7.x; 8.x; 9.0
phpems	phpems	8.0; 9.0

References

https://note.zhaoj.in/share/jw4Hp9cq7T69Permissions Required
https://vuldb.com/?ctiid.247357Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.247357Permissions Required, Third Party Advisory, VDB Entry
https://note.zhaoj.in/share/jw4Hp9cq7T69Permissions Required
https://vuldb.com/?ctiid.247357Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.247357Permissions Required, Third Party Advisory, VDB Entry

Timeline

Published: Dec 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-66559.8A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionalit CVE-2023-66567.5** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. It has been rated as critical CVE-2023-66579.8A vulnerability classified as critical has been found in SourceCodester Simple Student Attendance System 1.0. This affects an unknown part o CVE-2023-66589.8A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown CVE-2023-66597.5A vulnerability, which was classified as critical, has been found in Campcodes Web-Based Student Clearance System 1.0. This issue affects so CVE-2023-66606.5When a program running on an affected system appends data to a file via an NFS client mount, the bug can cause the NFS client to fail to cop CVE-2023-66718.8A vulnerability has been discovered on OJS, that consists in a CSRF (Cross-Site Request Forgery) attack that forces an end user to execute u CVE-2023-66725.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in National Keep Cyber Security Services CVE-2023-66736.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in National Keep Cyber Security Services CVE-2023-66759.8Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell t CVE-2023-66768.8Cross-Site Request Forgery (CSRF) vulnerability in National Keep Cyber Security Services CyberMath allows Cross Site Request Forgery. This CVE-2023-66779.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Financial Technology Online Coll