Vulnerability · Published Dec 17, 2025 · Assigned by VulnCheck
CVE-2023-53914UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability
Critical 9.8
In plain English
A critical-severity authorization bypass via user-controlled key in Ulicms from ulicms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.7%top 47.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51486 exploit
- Archived Product Webpage product
- VulnCheck Advisory: UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability third-party-advisory