What’s Vulnerable › Vulnerabilities

CVE-2023-53895: PimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-16 · updated 2026-06-17
• Weakness: CWE-285

Description

PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.

Affected products

• PimpMyLog: 1.7.14

References

• https://github.com/potsky/PimpMyLog
• https://www.exploit-db.com/exploits/51593
• https://www.pimpmylog.com/
• https://www.vulncheck.com/advisories/pimpmylog-improper-access-control-via-account-creation-endpoint

Get alerted when CVE-2023-53895 or the next vulnerability affects your stack