CVE-2023-53869CWE-434

WEBIGniter 28.7.23 Unrestricted File Upload Remote Code Execution

High · published December 15, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
42.9
In the wild
Unconfirmed
What it is

WEBIGniter 28.7.23 contains a file upload vulnerability that allows authenticated attackers to upload and execute dangerous PHP files through the media function. Attackers can leverage any created account to upload malicious PHP scripts that enable remote code execution on the application server.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00514 · 42.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-12-15T20:28Z
EPSS history
Timeline
  • 15 DEC 20:28Z
    WEBIGniter 28.7.23 Unrestricted File Upload Remote Code Execution
    cvelistv5