CVE-2023-53888 HIGH

CVE-2023-53888: Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation

Vendor Zomplog
Product Zomplog
Weakness CWE-94 · Code injection
Published December 15, 2025
Last update May 25, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.

Key dates

02Disclosure timeline

December 15, 2025 CVE published
May 25, 2026 Record updated