Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from… (CVE-2026-105885)

CVE-2026-105885 describes a deserialization of untrusted data vulnerability in 10Web Slider by 10Web slider-wd. This flaw allows an attacker with low privileges and no user interaction to perform object injection, potentially leading to full compromise of the affected system. The vulnerability affects all versions from an unspecified start point through version 1.2.62 inclusive. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, and no user interaction, with high impact on confidentiality, integrity, and availability.

Successful exploitation can result in complete compromise of the affected system, including unauthorized disclosure, modification, or destruction of data and disruption of service. The vulnerability allows object injection via deserialization of untrusted data, which can be leveraged by attackers to execute arbitrary code or manipulate application behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected application and monitor for suspicious activity related to object injection attempts.