CVE-2023-53914 — UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability
UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attacker…
Published: 2025-12-17 · CVSS: 9.3 · CVSS 4.0
UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7