CVE-2023-53927

PHPJabbers Simple CMS 5.0 Stored Cross-Site Scripting via Section Creation

PHPJabbers Simple CMS 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through section name parameters. Attackers can create sections with embedded JavaScript payloads that will execute when administrators view the sections, potentially enabling client-side code execution.

Affected

PHPJabbers · Simple CMS

CVSS v4.0 VULNCHECK

5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.28% chance of exploitation in the next 30 days, 20th percentile

Published

2025-12-17

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/51415

Security advisories

• https://www.vulncheck.com/advisories/phpjabbers-simple-cms-stored-cross-site-scripting-vi…
• https://www.phpjabbers.com

References

• CVE Record
• NVD entry