CVE-2023-53895
PimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint
- State
- Published
- Severity
- 9.3 Critical
- Published
- Dec 16, 2025
- Updated
- Jul 15, 2026
- Reserved
- Dec 16, 2025
Description
PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-285 Improper Authorization
Affected Products
| Product | Versions |
|---|---|
PimpMyLogPimpmylog |
|
References
- ExploitDB-51593exploit
- Pimp My Log Product Webpageproduct
- Pimp My Log GitHub Repositoryproduct
- VulnCheck Advisory: PimpMyLog 1.7.14 Improper Access Control via Account Creation Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.