Vulnerability · Published Dec 16, 2025 · Assigned by VulnCheck
CVE-2023-53899PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection
Critical 9.8
In plain English
A critical-severity server-side request forgery in PodcastGenerator from Podcastgenerator. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 52.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Podcastgenerator | PodcastGenerator | 3.2.9 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51565 exploit
- Podcast Generator Product Homepage product
- Podcast Generator GitHub Repository product
- VulnCheck Advisory: PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection third-party-advisory