Threat database

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.3	EPSS 0.6%	CVE-2025-66571UNA CMS · Deserialization of Untrusted Data Critical9.3EPSS 0.6%2025-12-04CVE Database V5CVE-2025-66571 UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize() without proper handling, allowing remote, unauthenticated attackers to inject arbitrary PHP objects and potentially write and execute arbitrary PHP code. EPSS 0.6%Vulnerability #cwe-502	CVE Database V5	2025-12-04

Page 1 of 1