Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2023-54339Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter
Critical 9.8
In plain English
A critical-severity OS command injection in Webgrind from jokkedk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.7%top 22.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51074 exploit
- Webgrind GitHub Repository product
- VulnCheck Advisory: Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter third-party-advisory