Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2023-46990: Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
CVE-2023-46990 · published 2 years ago
Summary
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| publiccms | publiccms |
4.0.202302.e cpe:2.3:a:publiccms:publiccms:4.0.202302.e:*:*:*:*:*:*:* |
Original advisory text
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
References
- https://github.com/sanluan/PublicCMS/issues/76#issue-1960443408 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46990... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-46990 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published20 Nov 2023
Updated31 Oct 2026
First seen29 Sep 2026
Track software like this
Free during beta