CVE-2023-53917

None

CVSS

—

EPSS

0.4%

Published

Dec 17, 2025

CISA due date

—

The record

Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated administrators to manipulate database queries. Attackers can exploit the 'id' parameter with crafted union-based queries to extract sensitive user information including usernames and password hashes.

Affected packages

Ecosystem	Package	Introduced	Fixed