CVE-2023-54339
Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jan 13, 2026
- Updated
- Mar 5, 2026
- Reserved
- Jan 10, 2026
Description
Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
Webgrindjokkedk |
|
References
- ExploitDB-51074exploit
- Webgrind GitHub Repositoryproduct
- VulnCheck Advisory: Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameterthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.