CVE-2023-53899

PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection

State: Published
Severity: 5.1 Medium
Published: Dec 16, 2025
Updated: Sep 30, 2026
Reserved: Dec 16, 2025

Description

PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N	VulnCheck
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
PodcastGeneratorPodcastgenerator	3.2.9Affected

References

ExploitDB-51565exploit
Podcast Generator Product Homepageproduct
Podcast Generator GitHub Repositoryproduct
VulnCheck Advisory: PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injectionthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.