CVE-2023-53914: Ulicms

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.

Affected products

• Ulicms Ulicms: version 2023.1 only

Published 2025-12-17. Last modified 2026-06-17.