CVE-2023-54339

Critical CVSS: 9.3

Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.

Vendor

Webgrind Project

Product

Webgrind

CWE

CWE-78

Yayın Tarihi

2026-01-13 23:16:01

Güncelleme

2026-02-03 19:21:26

Source Identifier

disclosure@vulncheck.com

KEV Date Added

Kategoriler

CWE-78 Webgrind CRITICAL Webgrind Project 2026

Referanslar

http://github.com/jokkedk/webgrind/ https://www.exploit-db.com/exploits/51074 https://www.vulncheck.com/advisories/webgrind-remote-command-execution-rce-via-datafile-parameter https://www.exploit-db.com/exploits/51074