CVE-2023-36992

HighCVSS 7.2

Published: 07/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.98%

58th percentile - higher than 58% of all known CVEs

Summary

Versions TravianZ 8.3.4 and 8.3.3 contain a PHP injection vulnerability in the config editor on the admin page, allowing remote attackers to execute PHP code.

Risk Assessment

Attackers can remotely execute arbitrary PHP code, potentially leading to system takeover and data leakage.

Recommendation

It is recommended to update to the latest version of TravianZ to mitigate this vulnerability and to monitor the system for unauthorized activities.

Other vulnerabilities in TravianZ

CVE-2023-36995Medium
TravianZ through version 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie.

Original NVD description (English source)

PHP injection in TravianZ 8.3.4 and 8.3.3 in the config editor in the admin page allows remote attackers to execute PHP code.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS