CVE-2023-53894
phpfm 1.7.9 Authentication Bypass via Type Juggling Vulnerability
- State
- Published
- Severity
- 9.3 Critical
- Published
- Dec 16, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 16, 2025
Description
phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass authentication and upload malicious PHP files to the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-1390 Weak Authentication
Affected Products
| Product | Versions |
|---|---|
phpfmDulldusk |
|
References
- ExploitDB-51594exploit
- phpFileManager Product Webpageproduct
- VulnCheck Advisory: phpfm 1.7.9 Authentication Bypass via Type Juggling Vulnerabilitythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.