CVE-2023-53888

Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation

CVSS 8.6 HIGHEPSS 0.8%CWE-94

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.6EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

15 Dec 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Zomplog · Zomplog

References

https://web.archive.org/web/20080616153330/http://zomp.nl/zomplog/https://www.exploit-db.com/exploits/51624 https://www.vulncheck.com/advisories/zomplog-remote-code-execution-via-authenticated-file-manipulation