This vulnerability is an unauthenticated PHP object injection in Broadcast Live Video versions before 7.1.3. It arises from unsafe deserialization of untrusted data (CWE-502), enabling remote attackers to execute arbitrary code. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity and ease of exploitation without privileges or user interaction. No official patch or remediation level has been stated in the available data. No known exploits in the wild have been reported as of the publication date.

Successful exploitation can lead to full compromise of the affected system, including complete loss of confidentiality, integrity, and availability. Attackers can execute arbitrary code remotely without authentication, potentially leading to system takeover, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor VideoWhisper.com for updates and apply any official patches once available. Until then, restricting access to the vulnerable application and employing network-level protections may reduce exposure.