CVE-2023-53899

PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection

PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.

Affected

Podcastgenerator · PodcastGenerator

CVSS v4.0 VULNCHECK

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.57% chance of exploitation in the next 30 days, 46th percentile

Published

2025-12-16

Updated

2026-09-30

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/51565

Security advisories

• https://www.vulncheck.com/advisories/podcastgenerator-blind-server-side-request-forgery-v…
• PodcastGenerator/PodcastGenerator
• https://podcastgenerator.net

References

• CVE Record
• NVD entry