Vulnerability in Dulldusk Phpfilemanager
CVE-2023-53894
phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass authentication and upload malicious PHP files to the server.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (47.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 47.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: -0.000
Affected products
- Dulldusk Phpfilemanager — versions 1.7.9
- Dulldusk Phpfm — versions 1.7.9
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/51594 (Exploit, Third Party Advisory, exploit)
- www.dulldusk.com/phpfm/ (Product, product)
- www.vulncheck.com/advisories/phpfm-authentication-bypass-via-type-juggling-vuln… (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2023-53894?
- CVE-2023-53894 is a critical-severity vulnerability in Dulldusk Phpfilemanager, classified under Weak Authentication. CVSS score: 9.8/10. Published 2025-12-16.
- How severe is CVE-2023-53894?
- Critical severity. CVSS v3 base score is 9.8 out of 10.