CVE-2023-53883

HIGH

Webedition CMS <2.9.8.8 - Authenticated RCE

Title source: llm

Description

Webedition CMS v2.9.8.8 contains a remote code execution vulnerability that allows authenticated attackers to inject system commands through PHP page creation. Attackers can create a new PHP page with malicious system commands in the description field to execute arbitrary commands on the server.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Mirabbas Ağalarov · textwebappsphp
https://www.exploit-db.com/exploits/51661

References (3)

Scores

CVSS v3 7.2
EPSS 0.0053
EPSS Percentile 67.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (2)
Webedition/Webedition CMS 2.9.8.8
webedition/webedition_cms 2.9.8.8
Published Dec 15, 2025
Tracked Since Feb 18, 2026