{"id":"CVE-2023-31689","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-31689","generatedAt":"2026-11-04T23:23:41.400Z","title":"In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter.","description":"In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute scripts to trigger command execution.","published":"2023-05-22T20:15:11.000Z","lastModified":"2026-06-17T05:57:22.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-434"],"affected":["wcms/wcms"],"epss":{"score":0.2022,"percentile":0.9747,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 20.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://github.com/vedees/wcms/issues/15","tags":["Exploit","Issue Tracking"],"source":"cve@mitre.org"},{"url":"https://github.com/vedees/wcms/issues/15","tags":["Exploit","Issue Tracking"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-31689","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}