{"id":"CVE-2023-53871","aliases":["EUVD-2025-203433","GHSA-xjx3-pxg9-f9p4"],"status":"published","title":"Soosyze 2.0.0 Unrestricted File Upload via Broken Upload Logic","description":"Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00638,"percentile":0.51105,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2025-12-15T20:28:14Z","modified":"2026-10-28T02:30:55Z","products":[{"vendor":"soosyze","product":"soosyze"}],"references":[{"url":"https://www.exploit-db.com/exploits/51718","tags":["exploit","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://soosyze.com/","tags":["product","Product","web"]},{"url":"https://github.com/soosyze/soosyze","tags":["product","Product","package"]},{"url":"https://www.vulncheck.com/advisories/soosyze-unrestricted-file-upload-via-broken-upload-logic","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53871","tags":["advisory"]},{"url":"https://soosyze.com"},{"url":"https://github.com/advisories/GHSA-xjx3-pxg9-f9p4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53871.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-53871","title":"Soosyze 2.0.0 Unrestricted File Upload via Broken Upload Logic","description":"Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.","status":"published","published":"2025-12-15T20:28:14.547Z","modified":"2026-04-07T14:06:57.927Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:35:31.264455Z"}],"euvd":[{"id":"EUVD-2025-203433","description":"Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.","status":"published","published":"2025-12-15T20:28:14Z","modified":"2026-04-07T14:06:57Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:13.718727Z"}],"ghsa":[{"id":"GHSA-xjx3-pxg9-f9p4","title":"Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML...","description":"Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.","status":"published","published":"2025-12-15T21:30:31Z","modified":"2025-12-30T21:31:29Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:05:24.798125Z"}],"nvd":[{"id":"CVE-2023-53871","description":"Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.","status":"published","published":"2025-12-15T21:15:49.543Z","modified":"2026-06-17T06:46:13.463Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:09:26.50087Z"}],"osv":[{"id":"CVE-2023-53871","title":"Soosyze 2.0.0 Unrestricted File Upload via Broken Upload Logic","description":"Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.","status":"published","published":"2025-12-15T20:28:14.547Z","modified":"2026-10-28T02:30:55.332415138Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:44:36.491684Z"}]}}