CVE-2023-53892

High · 7.2

CVSS

7.2

EPSS

0.9%

Published

Dec 15, 2025

CISA due date

—

The record

Blackcat CMS 1.4 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the jquery plugin manager. Attackers can upload a zip file with a PHP shell script and execute arbitrary system commands by accessing the uploaded plugin's PHP file with a 'code' parameter.

Affected packages

Ecosystem	Package	Introduced	Fixed