CVE-2023-53895

critical · 9.3

PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.

9.3

CVSS

0.7%

EPSS (exploit prob.)

51st

EPSS percentile

2025-12-16

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-285

Affected products

Vendor	Product	Affected versions
potsky	pimp_my_log	1.7.14

Check a specific version with /api/v1/cve/match.

References

https://github.com/potsky/PimpMyLog
https://www.exploit-db.com/exploits/51593
https://www.pimpmylog.com/
https://www.vulncheck.com/advisories/pimpmylog-improper-access-control-via-account-creation-endpoint

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-53895