CVE-2023-53975
Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Page
- State
- Published
- Severity
- 9.3 Critical
- Published
- Dec 22, 2025
- Updated
- Jul 15, 2026
- Reserved
- Dec 20, 2025
Description
Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
Atom CMSthedigicraft |
|
References
- ExploitDB-51086exploit
- Atom CMS GitHub Repositoryproduct
- VulnCheck Advisory: Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Pagethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.