CVE-2023-6654: PHPEMS Session Data session.cls.php deserialization

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-10 · updated 2026-06-17
Weakness: CWE-502

Description

A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.

Affected products

PHPEMS: 6.0, 7.0

References

https://note.zhaoj.in/share/jw4Hp9cq7T69
https://vuldb.com/?ctiid.247357
https://vuldb.com/?id.247357
https://note.zhaoj.in/share/jw4Hp9cq7T69
https://vuldb.com/?ctiid.247357
https://vuldb.com/?id.247357

Get alerted when CVE-2023-6654 or the next vulnerability affects your stack