CVE-2023-53914

9.8 CRITICAL
Published: December 17, 2025 Modified: December 24, 2025
View on NVD

Description

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://web.archive.org/web/20230314183734/https://en.ulicms.de/
Source: disclosure@vulncheck.com
Product
https://www.exploit-db.com/exploits/51486
Source: disclosure@vulncheck.com
Exploit
https://www.vulncheck.com/advisories/ulicms-authentication-bypass-via-mass-assignment-vulnerability
Source: disclosure@vulncheck.com
Third Party Advisory
https://www.exploit-db.com/exploits/51486
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Exploit

4 reference(s) from NVD

Quick Stats

CVSS v3 Score
9.8 / 10.0
EPSS (Exploit Probability)
0.7%
72th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-639

Affected Vendors

ulicms

Related CVEs

CVE-2025-52691 10.0
CVE-2025-15168 7.3
CVE-2025-15167 7.3
CVE-2025-15166 7.3
CVE-2025-15165 7.3