CVE-2023-6907
codelyfe Stupid Simple CMS Deletion Interface delete.php improper authentication
CVE-2023-6907 is a medium vulnerability (CVSS 5.4) in Codelyfe Stupid Simple Cms, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. No source names a fixed version.
- Severity
- 5.4 MediumCVSS 3.1, CVE List
- Exploit chance
- 1.20%EPSS, 68th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /file-manager/delete.php of the component Deletion Interface. The manipulation of the argument file leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-248269 was assigned to this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
What each source reports
CVE List Score used
codelyfe Stupid Simple CMS Deletion Interface delete.php improper authentication
A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /file-manager/delete.php of the component Deletion Interface. The manipulation of the argument file leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-248269 was assigned to this vulnerability.
- Record
CVE-2023-6907- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - CVSS 2.0
- 4.8
AV:A/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2023-59108
A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /file-manager/delete.php of the component Deletion Interface. The manipulation of the argument file leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-248269 was assigned to this vulnerability.
- Record
EUVD-2023-59108- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qm83-jg9g-2862
A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as...
A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /file-manager/delete.php of the component Deletion Interface. The manipulation of the argument file leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-248269 was assigned to this vulnerability.
- Record
GHSA-qm83-jg9g-2862- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /file-manager/delete.php of the component Deletion Interface. The manipulation of the argument file leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-248269 was assigned to this vulnerability.
- Record
CVE-2023-6907- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 4.8 Medium
AV:A/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.