CVE-2023-53926

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

P

HPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potentially extract or modify database information.

References

Link	Resource
https://www.exploit-db.com/exploits/51416	Exploit Third Party Advisory VDB Entry
https://www.phpjabbers.com/faq.php	Product
https://www.vulncheck.com/advisories/phpjabbers-simple-cms-sql-injection-via-column-parameter	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpjabbers:simple_cms:5.0:*:*:*:*:*:*:*

History

24 Dec 2025, 18:03

Type	Values Removed	Values Added
References	~~() https://www.exploit-db.com/exploits/51416 -~~	() https://www.exploit-db.com/exploits/51416 - Exploit, Third Party Advisory, VDB Entry
References	~~() https://www.phpjabbers.com/faq.php -~~	() https://www.phpjabbers.com/faq.php - Product
References	~~() https://www.vulncheck.com/advisories/phpjabbers-simple-cms-sql-injection-via-column-parameter -~~	() https://www.vulncheck.com/advisories/phpjabbers-simple-cms-sql-injection-via-column-parameter - Third Party Advisory
CPE		cpe:2.3:a:phpjabbers:simple_cms:5.0:::::::*
First Time		Phpjabbers Phpjabbers simple Cms

18 Dec 2025, 15:07

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-17 23:15

Updated : 2025-12-24 18:03

NVD link : CVE-2023-53926

Mitre link : CVE-2023-53926

CVE.ORG link : CVE-2023-53926

JSON object : View

Products Affected

simple_cms

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2023-53926", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-12-17T23:15:51.873", "references": [{"url": "https://www.exploit-db.com/exploits/51416", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "[email protected]"}, {"url": "https://www.phpjabbers.com/faq.php", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/phpjabbers-simple-cms-sql-injection-via-column-parameter", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potentially extract or modify database information."}], "lastModified": "2025-12-24T18:03:04.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpjabbers:simple_cms:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB1F6F0F-FE04-4934-B78A-6C0F5825AF8C"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}