PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection
Priority MEDIUM 64CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00571 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Podcastgenerator | PodcastGenerator | 3.2.9 | — | No fix listed | CNA |
- PodcastGenerator VendorPodcastgenerator Affected 3.2.9 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:podcastgenerator:podcast_generator:3.2.9:*:*:*:*:*:*:* | 3.2.9 | Vulnerable | Podcastgenerator |
- cpe:2.3:a:podcastgenerator:podcast_generator:3.2.9:*:*:*:*:*:*:* Versions 3.2.9 Vulnerable ·Podcastgenerator
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-53899
- 2026-10-03 Alias added: GHSA-wvwc-5cjj-52f5
References
More Podcastgenerator Podcast Generator vulnerabilities
- TI-2023-30203 PodcastGenerator Stored Cross-Site Scripting via Podcast Title Field CVSS 4.0MEDIUM 5.1
- TI-2023-30202 PodcastGenerator Stored Cross-Site Scripting via Freebox Content Field CVSS 4.0MEDIUM 5.1
- TI-2023-30201 PodcastGenerator Stored Cross-Site Scripting via Episode Title Field CVSS 4.0MEDIUM 5.1
- TI-2018-14251 Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter. CVSS 3.0MEDIUM 6.1
- TI-2025-43101 A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in… CVSS 3.1MEDIUM 4.8
Sources
- CVE-2023-53899 · CVE Program
- CVE-2023-53899 · NVD
- FIRST EPSS
- GHSA-wvwc-5cjj-52f5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences