CVE-2023-53894

9.3 criticalEPSS 0.6%

Critical (9.3) in dulldusk phpfilemanager. EPSS 0.6% chance of exploitation in the next 30 days.

phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass authentication and upload malicious PHP files to the server.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-1390
Published: 2025-12-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dulldusk:phpfilemanager

References

https://www.dulldusk.com/phpfm/
https://www.exploit-db.com/exploits/51594
https://www.vulncheck.com/advisories/phpfm-authentication-bypass-via-type-juggling-vulnerability

Check your stack JSON