What is CVE-2023-53894?

CVE-2023-53894 is a critical-severity vulnerability in Dulldusk Phpfilemanager, classified under Weak Authentication. CVSS score: 9.8/10. Published 2025-12-16.

How severe is CVE-2023-53894?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Dulldusk Phpfilemanager

CVE-2023-53894

phpfm 1.7.9 contains an authentication bypass vulnerability that allows attackers to log in by exploiting loose type comparison in password hash validation. Attackers can craft specific password hashes beginning with 0e or 00e to bypass au…

EPSS: 0.006 (42.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Dulldusk Phpfilemanager — versions 1.7.9
Dulldusk Phpfm — versions 1.7.9

Weakness classification (CWE)

CWE-1390 — Weak Authentication

References

disclosure@vulncheck.com (Exploit, Third Party Advisory, exploit)
disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2023-53894?: CVE-2023-53894 is a critical-severity vulnerability in Dulldusk Phpfilemanager, classified under Weak Authentication. CVSS score: 9.8/10. Published 2025-12-16.
How severe is CVE-2023-53894?: Critical severity. CVSS v3 base score is 9.8 out of 10.