CVE-2023-54339

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-54339
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54339.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-54339
Published
2026-01-13T22:52:09.832Z
Modified
2026-07-15T01:49:22.349125557Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter
Details

Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54339.json"
}
References

Affected packages

Git / github.com/jokkedk/webgrind

Affected ranges

Type
GIT
Repo
https://github.com/jokkedk/webgrind
Events
Introduced
f020c26910eaf6e5a48bb85e6448368a1225be1e
Last affected
f020c26910eaf6e5a48bb85e6448368a1225be1e
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:webgrind_project:webgrind:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.1"
        },
        {
            "last_affected": "1.1"
        },
        {
            "introduced": "0"
        }
    ]
}

Affected versions

1.*
1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-54339.json"