CVE-2023-54339

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-54339

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54339.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-54339

Published

2026-01-13T23:16:01.780Z

Modified

2026-03-14T12:23:17.169781Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.

References

Affected packages

Git / github.com/jokkedk/webgrind

Affected ranges

Type

GIT

Repo

https://github.com/jokkedk/webgrind

Events

Introduced

Last affected

f020c26910eaf6e5a48bb85e6448368a1225be1e

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.1"
        }
    ]
}

Affected versions

0.*

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1.*

1.0

1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54339.json"