CVE-2023-53899

CRITICAL

PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter ...

Affects 2 products across 1 vendor.

CVSS 3.19.8
CVSS v45.1
EPSS0.6%
Percentile46th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-918: Server-Side Request Forgery (SSRF)

Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.

Related Attack Patterns (CAPEC)
CAPEC-664 Server Side Request Forgery
via CWE-918

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

PodcastGenerator 3.2.9 is vulnerable to a blind server-side request forgery (SSRF) attack through the episode upload form, allowing attackers to inject XML and trigger external HTTP requests.

BSID: BS-2025-GLOBAL-177297-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-53899?
PodcastGenerator 3.2.9 is vulnerable to a blind server-side request forgery (SSRF) attack through the episode upload form, allowing attackers to inject XML and trigger external HTTP requests.
What is the CVSS score for CVE-2023-53899?
CVE-2023-53899 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.6%.
Is CVE-2023-53899 actively exploited?
No confirmed active exploitation of CVE-2023-53899 as of 2026-05-30.
How do I remediate CVE-2023-53899?
Priority: IMMEDIATE.
What systems are affected by CVE-2023-53899?
CVE-2023-53899 affects Podcast Generator Podcast Generator.
Vulnerability Details
CVE IDCVE-2023-53899
BSIDBS-2025-GLOBAL-177297-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2025-12-16
Last Modified2026-04-29
ICS Relevance15%
Weakness (CWE)
Server-Side Request Forgery (SSRF)
SourceNVD
Official Description

PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Attackers can manipulate the 'shortdesc' parameter during the creation of a podcast episode to inject XML, which can be used to perform blind SSRF attacks and send HTTP requests to arbitrary endpoints.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Podcast Generator Podcast Generator 3.2.9
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 303 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash756f6bacab14c3d0cc969eacec7c34f791e83898f2b2df33044d8959e6fb93d8bb1ad66904769d25a48e86e78d7ecac9187687a7e90009f06ba2a5887f79dbe0
Related CVEs affecting Podcast Generator
CVE-2009-1226 7.5 core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly ... CVE-2008-1124 6.8 Multiple PHP remote file inclusion vulnerabilities in Podcast Generator 1.0 B... CVE-2009-1230 6.5 Static code injection vulnerability in index.php in Podcast Generator 1.1 and... CVE-2021-47968 6.4 Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allow... CVE-2023-53918 6.1 PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability i...
View all Podcast Generator CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →