CVE-2023-54339

9.3 criticalEPSS 1.7%

Critical (9.3) in webgrind project webgrind. EPSS 1.7% chance of exploitation in the next 30 days.

Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2026-01-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

webgrind_project:webgrind

References

http://github.com/jokkedk/webgrind/
https://www.exploit-db.com/exploits/51074
https://www.vulncheck.com/advisories/webgrind-remote-command-execution-rce-via-datafile-parameter
https://www.exploit-db.com/exploits/51074

Check your stack JSON