CVE-2023-53878CWE-444

Member Login Script 3.3 Client-Side Request Desynchronization Vulnerability

Medium · published December 15, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Member Login Script 3.3 contains a client-side desynchronization vulnerability that allows attackers to manipulate HTTP request handling by exploiting Content-Length header parsing. Attackers can send crafted POST requests with smuggled secondary requests to potentially bypass server-side request processing controls.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00367 · 29.4th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2025-12-15T20:28Z
EPSS history
Timeline
  • 15 DEC 20:28Z
    Member Login Script 3.3 Client-Side Request Desynchronization Vulnerability
    cvelistv5