CVE-2023-53888

8.6 highEPSS 1.0%

High (8.6) in zomp zomplog. EPSS 1.0% chance of exploitation in the next 30 days.

Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2025-12-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zomp:zomplog

References

https://web.archive.org/web/20080616153330/http://zomp.nl/zomplog/
https://www.exploit-db.com/exploits/51624
https://www.vulncheck.com/advisories/zomplog-remote-code-execution-via-authenticated-file-manipulation
https://www.exploit-db.com/exploits/51624

Check your stack JSON