PT-2026-2425 · Extplorer · Extplorer

Erpaciocco · Published 2026-01-13 · Updated 2026-01-15 · CVE-2023-54335

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eXtplorer version 2.1.14

Description eXtplorer version 2.1.14 contains an authentication bypass that allows attackers to log in without a password by manipulating the login request. Successful exploitation enables attackers to upload malicious PHP files and execute remote commands on the vulnerable file management system. The vulnerability is exploitable via manipulation of the login process. The affected API endpoint is the login function. The vulnerable parameter is the login request.

Recommendations Apply a fix for eXtplorer version 2.1.14 to address the authentication bypass.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-54335

Affected Products

Extplorer

References · 11

• 🔥 https://exploit-db.com/exploits/51067 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-54335 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-54335 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-54335 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-54335 · Security Note
• https://osv.dev/vulnerability/CVE-2023-54335 · Vendor Advisory
• https://twitter.com/pulsepatchio/status/2011808215260877084 · Twitter Post
• https://extplorer.net · Note
• https://twitter.com/CVEnew/status/2011383041193636078 · Twitter Post
• https://vulncheck.com/advisories/extplorer-authentication-bypass-remote-code-execution-rce · Note
• https://twitter.com/VulmonFeeds/status/2011259955651719583 · Twitter Post