Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2023-54335eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)
Critical 9.8
In plain English
A critical-severity missing authentication in eXtplorer from Extplorer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 13.7% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)13.7%top 3.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Nuclei
Official description
eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system.
Affected products (as reported)
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51067 exploit
- Official eXtplorer Product Homepage product
- VulnCheck Advisory: eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE) third-party-advisory