CVE-2023-53926 PHPJabbers Simple CMS 5.0 SQL Injection via Column Parameter
Remote attackers can inject SQL payloads via the column parameter to extract or modify database information in PHPJabbers Simple CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-53926?
CVE-2023-53926 is a high-severity SQL injection vulnerability in PHPJabbers Simple CMS, published on 17 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attackers can inject crafted SQL payloads through the 'column' parameter in the index.php endpoint to potentially extract or modify database information.
Weakness: CWE-89
Which versions are affected by CVE-2023-53926?
It affects 1 product.
Products include Phpjabbers Simple Cms.
How do I fix CVE-2023-53926?
No fix has been published for CVE-2023-53926 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-53926 being exploited?
There is no known exploitation of CVE-2023-53926 in the wild and no public exploit code.
Other vulnerabilities in PHPJabbers Simple CMS
Sources
Also known as GHSA-mpqr-qwwp-p8mx.