PT-2025-51301 · Unknown · Webedition Cms

Mirabbas Ağalarov · Published 2025-12-15 · Updated 2025-12-21 · CVE-2023-53883

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Webedition CMS version 2.9.8.8

Description Webedition CMS version 2.9.8.8 has a flaw that permits authenticated attackers to execute system commands remotely. This is achieved by creating a new PHP page and inserting malicious system commands within the description field. This allows for arbitrary command execution on the server. The vulnerable functionality involves the creation of PHP pages. The affected parameter is the description field during PHP page creation.

Recommendations Apply a fix that prevents the execution of system commands within the description field during PHP page creation.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-53883

Affected Products

Webedition Cms

References · 7

• 🔥 https://exploit-db.com/exploits/51661 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53883 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53883 · Security Note
• https://webedition.org · Note
• https://twitter.com/VulmonFeeds/status/2000730427976192112 · Twitter Post
• https://vulncheck.com/advisories/webedition-cms-v-remote-code-execution-via-php-page-creation · Note
• https://twitter.com/CVEnew/status/2002857368338743311 · Twitter Post